Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-78336] Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authentica…

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the entitlements owned by the caller. This issue affects Apache Syncope: from 3.0.0-M0 through…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-87779] Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of…

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad alta en Parallels Desktop: escalada de privilegios local vía socket mundial

Parallels Desktop ejecuta el servicio prl_disp_service con permisos root a través de un socket accesible mundialmente (/var/run/prl_disp_service.socket), permitiendo a usuarios locales ejecutar comandos arbitrarios sin validación de firma ni pertenencia a grupos administrativos. La vulnerabilidad afecta principalmente a empresas en México y LATAM que usan Parallels Desktop en infraestructuras de desarrollo, testing y virtualización en macOS, exponiendo sistemas con múltiples usuarios o acceso compartido.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2023-32803] The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not pr…

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90651] Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify u…

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the api_ssl_verify and upstream_ssl_verify configuration keys are omitted from socket.yml, the generated configuration sets SOCKET_API_SSL_VERIFY='false' and UPSTREAM_SSL_VERIFY='false', and the OpenResty/Lua HTTP client used for outbound requests accepts an…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-90647] ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper ce…

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/09/2026

Vulnerabilidad de condición de carrera en Hoverfly anteriores a v1.12.8

Hoverfly, herramienta de código abierto para simulación de APIs, presenta una vulnerabilidad de race condition en modo Diff que afecta escrituras concurrentes sin sincronización. Cuando múltiples solicitudes proxy se procesan simultáneamente, la función AddDiff() accede sin mutex al mapa compartido responsesDiff, causando fallos fatales en sistemas que dependen de esta herramienta para testing y desarrollo. Empresas en LATAM que usan Hoverfly en entornos de CI/CD o ambientes de validación de APIs están expuestas a interrupciones operacionales.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78130] strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certifi…

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78132] strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parse…

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-45770] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registere…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-45768] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-89011] isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo funct…

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing '__proto__' path segments during ref negotiation. Attackers controlling a Git server can advertise a specially crafted ref such as '__proto__/corsProxy' to reroute all subsequent n…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88021] Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh t…

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in service names, namespaces, and partitions, causing the generated authorization rules to match more broadl…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-89043] passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signat…

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-45747] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88889] Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that…

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySour…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88891] OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing …

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88886] Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE…

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-host…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-75584] ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remo…

ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by sending a BPv7 bundle with a zero-length payload. The canonicalizePayloadBlock() function in bpsec_util.c passes bundle->payload.length to zco_clone() without validating it against zero, causing a failed CHKZERO assertion that triggers sm_Abort() and terminat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-64837] ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php,…

ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().

nvdaltovulnerabilidad CVSS 8.8 NVD