Alertas de Seguridad de la Información

M Crítico vulnerabilidad

23/09/2026

[CVE-2025-63564] SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to ex…

SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-18872] IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scri…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actio…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96276] If a malicious SDK container declares an extension point with a crafted `directory` path, and a deve…

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96560] LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when…

LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86708] ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of …

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86246] Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled …

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are r…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-19599] ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Exe…

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86248] CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled v…

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86350] Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in …

Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122,…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-82843] The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID …

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96257] A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function…

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-18162] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execut…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutralization of user-controlled input within the new Function constructor.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-18163] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execut…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-16346] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute a…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-87121] lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain …

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-76708] A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlyi…

A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unau…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-76709] A vulnerability exists in the internal administrative component of Analytics and Location Engine (AL…

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-28324] SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code exec…

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-82000] Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability…

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-81995] Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that co…

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.1 NVD