Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 2 días

Inyección de comandos en BOSH CLI para Windows en Cloud Foundry permite ejecución remota

Una vulnerabilidad de inyección de comandos (CVE-2026-47827, CVSS 7.5) afecta la herramienta BOSH CLI en entornos Windows dentro de Cloud Foundry, permitiendo a atacantes remotos ejecutar comandos arbitrarios del sistema. Esta exposición impacta directamente plataformas de orquestación de contenedores y servicios cloud en empresas de LATAM que utilizan Cloud Foundry como infraestructura de aplicaciones altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-63046] Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in …

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1]/[2] to solve …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-61400] Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in…

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's run and get diagnostics functionality for the system VMs and virtual routers. An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instance…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-50112] SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing t…

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-controlled metalink file containing internal targets. The Secondary Storage VM will retrieve the data and persist it as a template file, which can later be downloaded through normal APIs. RCE on KVM hypervisor via NFS, Metalink files with/without Direct Downloads: An authenticated Cl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta de bypass de autenticación en ArchitectPanel de FuyaWeb (CVE-2026-16323)

Se ha identificado una vulnerabilidad de tipo Execution After Redirect (EAR) en ArchitectPanel Web Admin Panel de FuyaWeb Internet and Informatics Services que permite eludir mecanismos de autenticación. La vulnerabilidad afecta versiones hasta el 28072026 y representa un riesgo alta para organizaciones en México y Latinoamérica que utilizan esta plataforma de administración web, comprometiendo el acceso a paneles de control y datos sensibles.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-18781] The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not v…

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-75796] The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized …

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the targeted account before performing privileged user management operations, allowing users with the Administrator role on a Multisite sub-site to take over any account on the network, including the Network Administrator's.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-16576] The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Man…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

Vulnerabilidad XSS almacenado alta en WPForms Pro para WordPress

El complemento WPForms Pro para WordPress es vulnerable a inyección de scripts almacenados en campos de texto simple y párrafo (versiones hasta 2.0.0.2) debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Este riesgo es alta para sitios comerciales, de servicios y gobierno en LATAM que dependen de formularios para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

Vulnerabilidad alta en Multicluster Engine (MCE) permite eliminar clústeres sin autorización

Se identificó un fallo en el componente clusterclaims-controller de Multicluster Engine (MCE) que permite a usuarios con permisos estándar manipular el campo `spec.namespace` para especificar y eliminar cualquier ManagedCluster, incluyendo el hub local-cluster o clústeres de otros inquilinos. La ausencia de validación de propiedad (ownership check) expone infraestructuras multiclúster en entornos empresariales de México y LATAM a pérdida de disponibilidad y movimientos laterales entre tenants.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-77642] tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signatu…

tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-72818] The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and app…

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-72848] SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documente…

SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no dom…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-72860] The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues se…

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate after a redirect, and its IPv4-mapped IPv6 branch is unreachable. The branch matches ^::ffff:(\d+\.\d+\.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69855] Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to di…

Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69519] Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose infor…

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69543] Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevat…

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69558] Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized …

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69419] Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to exe…

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-66800] Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose…

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD