Alertas de Seguridad de la Información

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-89010] WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string vi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/09/2026

Vulnerabilidad crítica en Hugo v0.161.0+ permite ejecución de código mediante TailwindCSS

Hugo, generador de sitios estáticos, ejecuta herramientas Node con permisos insuficientemente restringidos desde la versión 0.161.0. TailwindCSS, incluido en la lista de seguridad por defecto, requiere configuraciones altamente permisivas (--allow-addons, --allow-child-process, --allow-worker) que permiten eludir controles de seguridad previos. Esto afecta a empresas en LATAM que alojan sitios web con Hugo y utilizan TailwindCSS para compilación de estilos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-14560] The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded fi…

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

nvdcriticovulnerabilidad CVSS 10.0 NVD

? Crítico alerta

11/09/2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog. CVEs relacionados: CVE-2026-85706.

cisaus-certalerta CISA KEV

? Crítico alerta

11/09/2026

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Three Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-42016, CVE-2026-42018, CVE-2026-84869.

cisaus-certalerta CISA KEV

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-80424] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create ar…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81204] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-79724] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-78573] IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrativ…

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-45764] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 pars…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-89094] Forgejo before 16.0.4 allows remote code execution via a crafted template repository because templat…

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-85025] IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute ar…

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-75940] A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Ch…

A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attacker to access sensitive health-related information.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88044] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the serve/start RC interface accepts per-server proxyOpt.AuthProxy settings, and the FTP and S3 constructors in cmd/serve/ftp/ftp.go and cmd/serve/s3/server.go incorrectly check the process-global proxy.Opt.AuthProxy value instead. When the global value is empty, …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-52098] An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/predict…

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88899] knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in t…

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88018] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81467] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81468] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81046] Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability…

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.

nvdcriticovulnerabilidad CVSS 9.4 NVD