Alertas de Seguridad de la Información

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60642] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. …

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60633] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. …

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60467] Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core…

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks require human interaction from a person other than the attacker. Succ…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47026] Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open…

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attac…

nvdaltovulnerabilidad CVSS 7.4 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47015] Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA …

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). The supported version that is affected is 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and w…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46998] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person othe…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32824] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply `forwardToUrl` and `redirectUrl` values when triggering password reset or confirmation flows. Those values are then embed…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-63094] SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that al…

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a v…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-44745] SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under…

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the applic…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-31982] An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insuff…

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59806] Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that al…

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to re…

nvdaltovulnerabilidad CVSS 7.4 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-55431] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN` placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-47645] Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows …

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-48895] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co…

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-55237] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticat…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46955] Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). …

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks require human interaction from a person other than the attacker. Successful attacks of t…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46894] Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Pag…

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks o…

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46806] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the …

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46796] Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente…

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker. Succ…

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35302] Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp…

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise WebLogic Server. Successful attacks require human interaction from a person other than the attacker and while the vulnerabil…

nvdaltovulnerabilidad CVSS 8.3 NVD