Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/09/2026

[CVE-2026-58569] Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. …

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges..

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-18771] Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co…

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-18780] Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft…

Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Cross Site Request Forgery. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-18630] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows SQL Injection. This issue affects Talassoft Industrial Management Software: from V.4 before V.16.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84218] A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-co…

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a `target.url` value from a Jolokia POST request and passes it to `JMXServiceURL` and `JMXConnectorFactory` for establishing the remote JMX connection. The existing denylist only reje…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-79684] Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li…

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-51766] Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un…

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the local device and, on a master, fan out reboot commands to mesh slaves via sending a crafted MQTT message to the cs_broker component.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-58571] Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited p…

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary commands with root privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-58572] Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileg…

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to execute arbitrary code with root privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19513] The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to,…

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This m…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2024-14047] A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a dir…

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84145] Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR …

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84131] Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed …

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84123] Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was…

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84128] Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155.

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84117] Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-79683] Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with li…

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-58575] Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attack…

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

Vulnerabilidad alta en Kyverno anterior a 1.16.4 expone tokens de servicio en solicitudes HTTP

Kyverno versiones anteriores a 1.16.4 adjunta automáticamente el token de la ServiceAccount del controlador de admisión a solicitudes HTTP salientes en modo apiCall sin validación explícita de autorización. Un atacante puede exfiltrar este token dirigiendo solicitudes apiCall a servidores externos o controlados, comprometiendo completamente las políticas de Kyverno y los recursos del cluster Kubernetes.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

01/09/2026

Vulnerabilidad SSRF alta en Kyverno anterior a 1.18.0 permite inyección de solicitudes HTTP

Kyverno antes de la versión 1.18.0 contiene una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en apiCall.service.url que permite a usuarios autenticados enviar peticiones HTTP arbitrarias mediante inyección de entrada controlada por el usuario a través de sustitución de variables. Los atacantes pueden comprometer servicios internos, endpoints de metadatos en la nube y direcciones loopback, con datos de respuesta reflejados en mensajes de error de admisión. Esta vulnerabilidad afecta directamente a plataformas Kubernetes en producción en LATAM.

nvdaltovulnerabilidad CVSS 7.7 NVD