Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73750] Vulnerabilities exist in the authentication module that may improperly process malformed or truncate…

Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially crafted input from a compromised or hostile authentication server. Successful exploitation could result in a Denial-of-Service or potential remote code execution with elevated privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-78592] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana ca…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged res…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73719] An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could …

An arbitrary file write vulnerability exists in the API of HPE Networking Fabric Composer and could allow an authenticated administrative user to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73710] Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated …

Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to make limited unauthorized modifications to the underlying operating system and disrupt the availability of the affected system, requiring manual intervention to restore functionality.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73711] A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. S…

A privilege escalation vulnerability exists in the API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to gain administrative privileges leading to complete compromise of the HPE Networking Fabric Composer host.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73715] A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote a…

A vulnerability in the API of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73702] A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful…

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-73704] A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploi…

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-72649] Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead…

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and de…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-8712] Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticat…

Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to overr…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-83551] Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in …

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-52130] llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.…

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84203] Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their passwor…

Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain account access. An attacker with a stolen refresh token can call the RefreshToken RPC to obtain new access tokens and rotate the refresh token indefinitely, bypassing the password change security measure.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-10195] The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and incl…

The FS-Poster plugin for WordPress is vulnerable to Remote Code Execution in versions up to and including 8.0.1. This is due to insufficient input sanitization of the FFmpeg path parameter before passing it to the exec() function, combined with missing authorization checks on the REST API endpoints. This makes it possible for authenticated attackers, with subscriber-level access and above, to exec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84233] A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containin…

A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integ…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84111] A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of t…

A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84115] A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown functio…

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 i…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-79686] Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li…

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-79684] Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li…

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19513] The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,…

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This m…

nvdaltovulnerabilidad CVSS 8.1 NVD