Alertas de Seguridad de la Información

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-17472] IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unau…

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wildcards in RBAC permission definitions.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-76708] A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlyi…

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unau…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-76709] A vulnerability exists in the internal administrative component of Analytics and Location Engine (AL…

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75682] Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command (…

Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploita…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75684] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75689] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75697] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75698] Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could…

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-94456] Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically…

Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8’s deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exp…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-86059] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organizatio…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80156] Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to write arbitrary data to any location on the device's filesystem, leading to remote code execution. The upload filename validation strips ba…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80151] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set nfs download command that passes unsanitized user input to a system() call. Attackers wit…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80152] Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set script schedule command that passes unsanitized user input to a system() call. Attackers …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80154] All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain a…

All firmware versions of Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Agent validation. Session tokens are generated deterministically from the device model and the current time at one-…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80155] Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configuration files and upload files to arbitrary filesystem locations, leading to remote code execution. The web …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80145] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by exploiting the set cifs password command that passes unsanitized user input to a system() call. Attackers wi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80146] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom read command that copies unbounded user input into a bounded stack buffer before passing it to …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80147] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow vulnerability that allows authenticated attackers to potentially execute arbitrary code by exploiting an undocumented mfc eeprom write command that copies unbounded user input into a bounded stack buffer before passing it to…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80144] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom write command that passes unsanitized user input to a system() call. Attackers can authenticate as …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-80143] Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmwa…

Lantronix SLC8000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers to execute arbitrary shell commands as root by exploiting an undocumented mfc eeprom read command that passes unsanitized user input to a system() call. Attackers can authenticate as a…

nvdcriticovulnerabilidad CVSS 9.9 NVD