Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94450] Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow…

Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 and earlier may allow an unauthenticated remote user to cause a denial of service by shutting down a server endpoint via a single crafted UDP datagram. Only server endpoints specifically configured to send Retry packets are affected. To remediate this issue, users should upgrade to version v1.89.0 or later.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-76712] A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized ac…

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security co…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-76715] A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable …

A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-28325] SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code exec…

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95861] A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability f…

A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95862] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77544] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77555] A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability foun…

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77556] A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found…

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77558] A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found…

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75744] Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability …

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's accoun…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75632] CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could…

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95656] A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects …

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and coul…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94384] Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principa…

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization val…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-93345] MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labell…

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83597] Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent…

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94455] An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable withou…

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The endpoint's only check is that the request body carries a token bearing a valid signature from the instanc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83603] Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command…

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The account can direct root fail2ban-client to a malicious UNIX socket, and fail2ban/client/csocket.py CSocket.receive() passes the returned data…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83598] Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Ag…

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulner…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94640] A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a…

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.

nvdaltovulnerabilidad CVSS 7.5 NVD