Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-70926] Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notific…

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base Sco…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-70862] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Applicatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-70855] Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Tr…

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks require human interaction from a person other than the attacker and while the vuln…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-61066] Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg…

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact a…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-60905] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker a…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-60782] Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmissio…

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Con…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-60720] Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg…

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-60721] Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg…

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Mana…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-60727] Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Leg…

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Mana…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-18963] A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core…

A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-75913] CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection …

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an at…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

Vulnerabilidad crítica de autenticación en ArcadeDB anteriores a 26.8.1 (CVE-2026-75854)

ArcadeDB versiones anteriores a 26.8.1 presentan una vulnerabilidad crítica (CVSS 9.8) en el plugin de protocolo Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto Redis y ejecutar comandos arbitrarios contra cualquier base de datos del servidor sin proporcionar credenciales. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan ArcadeDB en entornos de producción con acceso a redes inseguras o expuestas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

Vulnerabilidad crítica en Grav anterior a 2.0.14 permite escalada de privilegios a super-admin

Grav antes de la versión 2.0.14 no valida correctamente el campo de acceso en el blueprint de grupos, permitiendo que operadores con permisos de admin.users escalen privilegios a super-admin. Esto habilita acceso a funciones críticas como evaluación Twig y scheduler, comprometiendo la integridad de sitios web en producción. El impacto afecta especialmente a portales corporativos y plataformas de contenido en empresas mexicanas y latinoamericanas que hospedan instancias de Grav.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-75626] SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s…

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

17/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en routers Wavlink WN531P3 y WN535M1

Se identificó una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en los routers Wavlink WN531P3 y WN535M1 versión V250922. La falla reside en la función strcpy del componente Export Pingortrace CGI (/etc/lighttpd/www/cgi-bin/export_pingortrace.cgi) y puede ser explotada remotamente manipulando el parámetro HTTP_COOKIE. El exploit ha sido divulgado públicamente, aumentando el riesgo para infraestructuras de telecomunicaciones y empresas en LATAM que utilizan estos equipos.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/08/2026

Vulnerabilidad crítica de autenticación en openssl_encrypt anterior a v1.4.0

openssl_encrypt versiones anteriores a 1.4.0 contiene un fallo grave en la función verify_api_token que acepta cualquier token Bearer sin validación, permitiendo a atacantes cargar claves públicas arbitrarias, enumerar todas las claves existentes y revocar accesos de otros usuarios. Esta vulnerabilidad afecta directamente sistemas de encriptación y gestión de certificados críticos en infraestructuras de LATAM, especialmente en sectores financiero, salud y gobierno que dependen de esta librería para autenticación API.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/08/2026

Vulnerabilidad crítica de escape de sandbox en openssl_encrypt anterior a 1.4.0

openssl_encrypt versiones anteriores a 1.4.0 contienen una vulnerabilidad de escape de sandbox (CVSS 9.8) en IsolatedPluginExecutor que expone objetos de tipo Python en builtins de exec() restringido. Atacantes pueden recorrer la jerarquía de clases Python mediante __class__.__mro__.__subclasses__() para acceder a funciones del sistema y ejecutar comandos OS arbitrarios. Esta vulnerabilidad afecta directamente a aplicaciones que utilizan esta librería para procesamiento seguro de código en entornos empresariales de LATAM.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/08/2026

Vulnerabilidad crítica de inyección de objetos PHP en plugin ARForms para WordPress

El plugin ARForms (Contact Form, Survey, Quiz & Popup Form Builder) para WordPress contiene una vulnerabilidad de inyección de objetos PHP (CVE-2024-13784, CVSS 9.8) en versiones hasta 1.8.5 que permite a atacantes no autenticados inyectar objetos maliciosos mediante deserialización de datos en envíos de formularios. Aunque actualmente no hay cadenas POP conocidas explotadas, esta vulnerabilidad expone sitios web en México y Latinoamérica que utilicen este plugin, afectando formularios de contacto, encuestas y popups que interactúan directamente con usuarios.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73042] SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing…

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

nvdcriticovulnerabilidad CVSS 9.0 NVD