Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-34223] A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click…

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected applicatio…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81798] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84817] Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84818] Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

Unauthenticated Cross Site Scripting (XSS) in Open User Map

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84820] Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons…

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76561] A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificat…

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achievi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81781] Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting In…

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81790] Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez…

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-71375] Improper restriction of XML external entity reference vulnerability in Cosminexus Component Containe…

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 bef…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

CVE-2026-69361 Microsoft Exchange Server Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-69361 Microsoft Exchange Server Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

exchangespoofing Microsoft MSRC

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76967] SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally…

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This res…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86544] knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti…

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86540] knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project co…

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86437] Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with o…

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which exec…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86438] Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire a…

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86502] In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server a…

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86504] In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev …

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80166] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD