Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45552] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

P Crítico vulnerabilidad

10/06/2026

CVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0268 Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: Prisma Access.

firewallngfwprisma-access PAN PSIRT

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-9067] The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilit…

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos…

nvdcriticovulnerabilidad CVSS 9.1 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2026-26241] A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can…

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdcriticovulnerabilidad CVSS 9.1 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2026-26240] A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can…

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdcriticovulnerabilidad CVSS 9.1 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2025-66276] QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.…

QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

nvdcriticovulnerabilidad CVSS 9.8 NVD

E Crítico vulnerabilidad

10/06/2026

[CVE-2026-45328] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA update…

nvdcriticovulnerabilidad CVSS 9.3 NVD

A Crítico vulnerabilidad

09/06/2026

[CVE-2026-48303] Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-47938] Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Req…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

09/06/2026

[CVE-2026-47928] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-30141] An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function …

An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via a crafted GIF file.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-10045] Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121,…

Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

09/06/2026

[CVE-2026-34691] Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored C…

Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control…

nvdcriticovulnerabilidad CVSS 9.3 NVD

F Crítico vulnerabilidad

09/06/2026

[CVE-2026-49841] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, the mod_verto HTTP request handler allocates a fixed 2 MiB buffer for a POST application/x-www-form-urlencoded body but accepts Content-Length up to just under 10 MiB. The body-read loop is bo…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-47643] External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute…

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-47291] Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code o…

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-45657] Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-44815] Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code o…

Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD