Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72694] A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops priv…

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. Thi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15562] A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or …

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15563] A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without auth…

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15565] A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint witho…

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15567] A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2…

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15554] the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any sh…

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15555] A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicat…

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15556] A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion …

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15560] when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs …

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15561] A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou…

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

CVE-2026-62829 Microsoft SharePoint Server Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62829 Microsoft SharePoint Server Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

sharepointspoofing Microsoft MSRC

R Alto vulnerabilidad

11/08/2026

CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

sharepointspoofing Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability. Tipo: Bypass de Característica de Seguridad.

windowssfb Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-62899 .NET Security Feature Bypass Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62899 .NET Security Feature Bypass Vulnerability. Tipo: Bypass de Característica de Seguridad.

dotnetsfb Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-62915 Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62915 Microsoft Exchange Server Security Feature Bypass Vulnerability. Tipo: Bypass de Característica de Seguridad.

exchangesfb Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-64922 Microsoft SharePoint Server Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-64922 Microsoft SharePoint Server Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

sharepointspoofing Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-65660 Microsoft SharePoint Server Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-65660 Microsoft SharePoint Server Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

sharepointspoofing Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

exchangeeop Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-70304 Windows DNS Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70304 Windows DNS Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

windowseop Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

CVE-2026-70330 Windows DNS Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70330 Windows DNS Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

windowseop Microsoft MSRC