Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95653] Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creatio…

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95655] Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowi…

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-80148] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd builds its SSH connection target using …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-80149] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish SSH connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the web…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-80150] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882 contain a server-side request forgery vulnerability in the WebSSH/WebTelnet listener that allows unauthenticated attackers to cause the affected device to establish Telnet connections to attacker-controlled endpoints. The custom shellinaboxd uses the rooturl parameter from the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75608] Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/…

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/local/nginx/conf/nginx.conf requires authentication but does not require an administrator role for GET requests, exposing the proxied go2rtc API to viewer users. An authenticated viewer can request the streams, config, log, and stack subpaths to obtain internal a…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-70410] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in …

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Class.forName(String) which by default triggers initialization. This may lead to the execution of static initializer blocks in arbitrary classes…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-56681] 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to re…

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95500] A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted …

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65128] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQ…

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65130] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS…

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65178] NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted mod…

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65179] NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untruste…

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65118] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause im…

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-65114] NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause mi…

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95499] A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects…

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_uploaded_file of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95271] A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is …

A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_authentication of the file changedetectionio/flask_app.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

Inyección SQL ciega en HashBar WordPress Notification Bar (CVE-2026-94117)

Se detectó una vulnerabilidad alta de inyección SQL en el plugin HashBar para WordPress (versiones hasta 2.0.3) que permite a atacantes ejecutar consultas SQL no autorizadas contra bases de datos de sitios web. Esta vulnerabilidad afecta especialmente a pequeñas y medianas empresas en LATAM que utilizan WordPress con plugins de barras de notificación para campañas de marketing. Un atacante podría extraer datos sensibles, modificar registros o acceder a credenciales de administrador sin requiere autenticación previa.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

22/09/2026

Desbordamiento de búfer en libslirp afecta hosts con DHCPv6 y TFTP

Se identificó un desbordamiento de búfer basado en heap en los constructores de respuesta DHCPv6 y TFTP de libslirp. Cuando el host está configurado con MTU pequeño, las opciones CLIENTID DHCPv6 o blksize TFTP suministradas por el guest pueden desbordar el búfer de respuesta con contenido controlado por atacante, resultando en negación de servicio y potencial ejecución remota de código en el proceso host. Esta vulnerabilidad afecta infraestructuras de virtualización en data centers y ambientes cloud en LATAM.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad de bypass de autenticación en Taxi Booking Manager for WooCommerce

Taxi Booking Manager for WooCommerce (versiones anteriores a 2.0.8) contiene una vulnerabilidad de bypass de autenticación que permite a atacantes eludir controles de acceso mediante canales alternativos. Esto afecta directamente a agencias de transporte y plataformas de reserva en LATAM que utilizan este plugin, exponiendo datos de clientes y operaciones de negocio. El CVSS 7.3 indica alto riesgo de explotación remota sin autenticación previa.

nvdaltovulnerabilidad CVSS 7.3 NVD