Alertas de Seguridad de la Información

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102106] Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administr…

Improper authentication in a Kiteworks Email Protection Gateway administrative service. An administrative service in Kiteworks Email Protection Gateway did not consistently enforce administrator authentication, so the required password check could be bypassed. An attacker who referenced a valid administrator account could potentially create, modify, or delete internal users and managed domains and…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-87830] In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions…

In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the actual XML element path. A remote SOAP peer may therefore send a required element without the expected signature or encryption. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-97196] Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP al…

Improper Validation of Unsafe Equivalence in Input vulnerability in Liquid Web / StellarWP GiveWP allows Authentication Bypass. This issue affects GiveWP: from n/a through 4.16.9.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-103056] AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service …

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitr…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100291] In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process manageme…

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-82973] Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox befo…

Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticated attacker, when bearer-token authentication is not configured, to inject additional IMAP commands into an authenticated upstream mailbox connection via crafted folder, UID, or search values.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-88804] An unauthenticated update of public UI settings could be used by remote attackers to execute a store…

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 before 2.11.18.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

28/09/2026

Vulnerabilidad crítica de desbordamiento de buffer en FAST FAC1200R 5.0

Se identificó una vulnerabilidad de desbordamiento de búfer basado en pila (CVSS 9.9) en el analizador MmtAtePrase del dispositivo FAST FAC1200R versión 5.0_20201119_1.0.2, permitiendo explotación remota sin autenticación. El exploit se encuentra públicamente disponible y el fabricante no ha respondido a notificaciones previas. Esta vulnerabilidad afecta principalmente a empresas de telecomunicaciones, ISPs y proveedores de servicios en México y LATAM que utilizan equipos FAST en infraestructuras críticas.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-100886] A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. …

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-101065] Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, th…

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped to a synthetic "nobody" user that holds the Owner and Admin roles, so any unauthenticated party who ca…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-100721] vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an e…

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-str…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100714] Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlik…

Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp, the field has no string_regexp or required_otp guard, and its value is concatenated unescaped into the acme.sh command line built in lib/Froxlor/Cron/Http/LetsEncrypt/AcmeSh.php and executed by the root cron via FileDir::safe_exec. Because safe_exec only bla…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-13249] An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web manageme…

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updati…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de inclusión de archivos en Visual Composer Website Builder para WordPress

El plugin Visual Composer Website Builder para WordPress (versiones hasta 45.16.0) contiene una vulnerabilidad de inclusión local de archivos (LFI) que permite a atacantes no autenticados ejecutar código PHP arbitrario en el servidor. Esta falla afecta directamente a miles de sitios web en México y LATAM que utilizan este constructor visual, comprometiendo datos sensibles y permitiendo control total del servidor.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de autenticación en DIAEnergie permite bypass de acceso (CVE-2026-78308)

DIAEnergie anterior a versión 1.11.00.022 contiene una vulnerabilidad de autenticación impropia (CVSS 9.8) que permite a atacantes eludir controles de acceso sin credenciales válidas. Afecta directamente a operadores de infraestructura energética, distribuidoras y gestores de demanda en México y Latinoamérica. El riesgo es crítico en entornos de control industrial y sistemas SCADA.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de escalada de privilegios en plugin Paytium para WordPress

El plugin 'Paytium: Mollie payment forms & donations' para WordPress contiene una vulnerabilidad de escalada de privilegios (CVSS 9.8) en versiones hasta 5.0.3 que permite a atacantes eludir mecanismos de validación de firmas y obtener privilegios administrativos. Afecta directamente a tiendas de e-commerce, plataformas de donaciones y sistemas de pago integrados con Mollie en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96758] orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer …

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96755] orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen…

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-18872] IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scri…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actio…

nvdcriticovulnerabilidad CVSS 9.3 NVD