Alertas de Seguridad de la Información

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-88920] An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote…

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/09/2026

Omisión de validación en Apache MINA SSHD permite eludir autenticación LDAP

Apache MINA SSHD versiones 1.2.0 a 2.19.0 y 3.0.0-M1 a 3.0.0-M5 contienen una falla en LdapPasswordAuthenticator que permite bypass de autenticación. Afecta servidores SSH en Java que integren LDAP para validación de credenciales, comprometiendo el acceso a sistemas críticos de infraestructura en organizaciones latinoamericanas.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

Omisión de autenticación en Apache MINA SSHD 2.0.0 a 3.0.0-M5 (CVE-2026-77185)

Apache MINA SSHD, librería Java para implementar servidores SSH, contiene una vulnerabilidad crítica (CVSS 9.1) que permite eludir la autenticación en configuraciones específicas de autenticación asincrónica. Afecta principalmente a servidores SSH personalizados en entornos de infraestructura crítica, plataformas de acceso remoto y soluciones de integración en LATAM. La explotación podría comprometer la integridad de sistemas de gestión de infraestructura, bases de datos y servidores de aplicaciones.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102458] Vulnerabilidad crítica de autenticación ausente en EasyFlow .NET de Digiwin

EasyFlow .NET contiene una vulnerabilidad de autenticación ausente (CVSS 9.8) que permite a atacantes remotos no autenticados obtener contraseñas en texto plano de otros usuarios a través de una API específica. Esta falla afecta directamente a empresas en México y Latinoamérica que utilizan esta plataforma para gestión de flujos de trabajo, exponiendo credenciales de usuarios y datos sensibles sin requerir validación de identidad.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-103110] Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that …

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102911] A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the fi…

A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 0.11.8 is able to address this issue. This patch is …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102794] A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown proces…

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-102793] A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_tim…

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102792] A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of …

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-68068] The "screenID" parameter in the electronic transaction queue viewer feature within the manual transa…

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76722] Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant…

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-53988] Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints …

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-77177] Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other prod…

Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prompt injection (with Jinja2 template syntax) can be used to achieve server-side expression evaluation without sanitization.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2023-54400] Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that al…

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Name parameter of the getEmpByname action without any authentication. Attackers can exploit UNION-based SQL injection techniques against the Microsoft SQL Server backend to extract, disclose, and modify database contents, with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de autenticación en Hitachi Energy RTU500 permite carga de firmware no autorizada

Se ha identificado una vulnerabilidad de omisión de autenticación (CVE-2026-8065, CVSS 9.1) en el endpoint de actualización de firmware de Hitachi Energy RTU500 que permite a atacantes no autenticados cargar firmware malicioso mediante solicitudes POST modificadas. La explotación exitosa podría comprometer la funcionalidad operativa, integridad y disponibilidad del dispositivo, afectando principalmente infraestructuras críticas de energía, agua y telecomunicaciones en LATAM que dependen de estos controladores RTU.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102240] A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the…

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not res…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101354] A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the fun…

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101264] A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the…

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101263] A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing …

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101261] A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/Z…

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD