Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20333] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20334] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Ad…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management Center Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally disc…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20295] A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and…

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, remote attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during sftunnel TLS connection setup. An attacker could exploit this vulnerability by sending craf…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20300] A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection …

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative credentials. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affecte…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20247] A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injectio…

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected device. A successful exploit could allow the attacker to modify data in the underlying database.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20249] A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv…

A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly. This vulnerability is due to a logic error during the certificat…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20250] A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security A…

A vulnerability in Datagram TLS (DTLS) message handling of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software for Cisco Secure Firewall 3100 Series and 4200 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper r…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20135] A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software…

A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper buffer management during the TLS 1.3 connection. An attacker could exploit this vulnerability by sending a c…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20154] A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewa…

A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a denial of service (DoS) condition. This vulnerability is due to improper rate l…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20222] A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (AS…

A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper resource management when handling EIGRP update …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-86865] Tanium addressed a SQL injection vulnerability in Asset.

Tanium addressed a SQL injection vulnerability in Asset.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-87024] Tanium addressed a SQL injection vulnerability in Asset.

Tanium addressed a SQL injection vulnerability in Asset.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-87105] Tanium addressed a SQL injection vulnerability in Threat Response.

Tanium addressed a SQL injection vulnerability in Threat Response.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-86831] Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network P…

Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS Network Policy Agent before v1.4.0 might allow an authenticated remote user to bypass NetworkPolicy enforcement on co-located pods in other namespaces via crafted pod and namespace names that produce pod identifier collisions. To remediate this issue, users should upgrade to Amazon EKS Network Policy Agen…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20361] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20361 are related to SQL injection issues that are grouped un…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92729] SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytic…

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-86003] CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-ove…

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy used by UDP, TCP, and DNS-over-TLS. An unauthenticated client can send an RFC 2136 UPDATE that the pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-86043] Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the o…

Skipper is an HTTP router and reverse proxy for service composition. Prior to version 0.27.37, the opaAuthorizeRequestWithBody filter can authorize an oversized request after Skipper truncates the body presented to Open Policy Agent because the input.truncated_body signal is derived from Content-Length rather than the actual read result. In filters/openpolicyagent/openpolicyagent.go, ExtractHttpBo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-81875] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose small raw-DEFLATE payload expands to a very large value. SHCParser.decodeJWT()…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-81876] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can enter an infinite loop while processing attacker-controlled Smart Health Card JWT content whose header contains zip: "DEF" and whose raw-DEFLATE payload is empty or truncated. SHC…

nvdaltovulnerabilidad CVSS 7.5 NVD