Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81630] The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updat…

The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96883] pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2…

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97324] A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the …

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97326] A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d…

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93289] The affected products are vulnerable to command injection attack that could allow an unauthenticated…

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93354] Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthe…

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and cl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-82164] Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment …

Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-82566] The Botslab G980H dash camera firmware contains a session management vulnerability in which authenti…

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism in…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-84399] The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based …

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated contex…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-85496] The Botslab G980H dash camera firmware generates session identifiers using a small sequential value …

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-77967] The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately ve…

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96749] An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled n…

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party wit…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-89325] An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windo…

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81455] Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication f…

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-81473] Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulne…

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-82157] Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate V…

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-77293] TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:…

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any tri…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-77294] TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store a…

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted import path. The value is consumed by the clients in server/src/nest/llm-parse/clients/openai-compatible…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61823] code16 Sharp is a Laravel-based framework for building content-management and administrative interfa…

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the `srcdoc` attribute on iframe elements. Although markup inside `srcdoc` is HTML-encoded during sanitization, browsers decode attribute entities before interpr…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61825] code16 Sharp is a Laravel-based framework for building content-management and administrative interfa…

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. …

nvdaltovulnerabilidad CVSS 8.7 NVD