Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105392] A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an …

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The proj…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-94591] Armatura One stores database and message-broker credentials in an install configuration file, encryp…

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, a…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-47097] AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows una…

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

Divulgación de información en BVMS 4.5 a 12.3 permite ataques de intermediario

Una vulnerabilidad de divulgación de información afecta BVMS (Bosch Video Management System) versiones 4.5 hasta 12.3. Atacantes en posición de intermediario (MitM) pueden interceptar comunicaciones y obtener acceso no autorizado a datos sensibles. Empresas con sistemas de vigilancia Bosch en México y LATAM deben evaluar su exposición inmediata.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103055] AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime We…

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-18181] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-18154] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-28326] SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execu…

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta en Dell OpenManage Server Administrator por clave criptográfica hardcodeada

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 contiene una vulnerabilidad de clave criptográfica hardcodeada (CVSS 8.1) que permite acceso no autenticado remoto. Afecta servidores físicos en centros de datos y entornos empresariales de México y Latinoamérica que utilizan esta herramienta de administración remota. Un atacante remoto podría comprometer sistemas altas de infraestructura sin requerir credenciales.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90510] A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the func…

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to b…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81821] The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files…

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80114] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded as a hardcoded literal in the distributed binary and computing valid MD5 authentication tags for arbitr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76847] act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actio…

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied workflow_run_backend_id and never check that it belongs to the requester: validateRunIDV4 in pkg/artifacts/art…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-63423] During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessori…

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-34635] is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security f…

is affected by a Use of Hard-coded Cryptographic Key vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66763] SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated w…

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected inform…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-18411] The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Blueto…

The KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can leverage this weakness to issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13184] In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is …

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54833] Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

Unauthenticated Backdoor in Enable CORS

nvdaltovulnerabilidad CVSS 7.4 NVD