Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35289] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: D…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of Peopl…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35295] Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCente…

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Si…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35299] Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supp…

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 8.8 (C…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35279] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: P…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of Peopl…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35274] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: D…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in unauthorized access…

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35276] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: A…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Server). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of People…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35265] Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Su…

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 8.…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35267] Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServic…

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2018-25437] WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows …

WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-53868] Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register acco…

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-53981] Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism th…

Cap-go prior to 12.128.2 contains an account takeover vulnerability in its email change mechanism that allows an attacker with temporary authenticated session access to change the registered email address without re-authentication such as password or MFA verification. Attackers can redirect verification to an attacker-controlled email address and subsequently perform a password reset to permanentl…

nvdaltovulnerabilidad CVSS 7.6 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50085] The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards th…

The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS ofCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6 High). When combined with CVE-2026-50082, CVE-50083, and CVE-50084, this can lead to …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-50245] Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no…

Brickcom cameras allow unauthenticated access to live snapshot images via the /ONVIF endpoint and no authentication is required to retrieve still images from the camera feed.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46612] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission storagesvc component registers archive CRUD handlers (/v1/archive GET / POST / DELETE and /v1/archives list) directly on its HTTP router without performing any authentication or authorization. Any caller able to reach the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45567] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-9045] During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessori…

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-50512] Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker t…

Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-9212] Insufficient authentication and input validation in the listed NETGEAR models allow users connected …

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2023-54350] WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder co…

WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder connector that allows unauthenticated attackers to upload and execute arbitrary PHP files. Attackers can send POST requests to the connector.minimal.php endpoint with mkfile and put commands to create malicious PHP files in the file_manager directory and execute them on the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45327] TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent…

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcry…

nvdaltovulnerabilidad CVSS 8.2 NVD