Alertas de Seguridad de la Información

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-79569] Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter…

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

08/09/2026

[CVE-2026-78997] Vulnerabilidad Android en Android OS - CVSS 9.3

Vulnerabilidad de seguridad en Android (Android OS): Vulnerabilidad de seguridad en Android. CVSS: 9.3. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-os CVSS 9.3 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-75156] Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of A…

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attac…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-26084] A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4…

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-79576] An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to …

An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-61516] Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that…

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12744] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12745] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12645] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12646] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12647] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12650] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

Vulnerabilidad crítica en hawtio-operator expone claves de firma de OpenShift

Se encontró una flaw en hawtio-operator que permite la lectura no autorizada de la clave privada de firma de la autoridad certificadora (CA) de servicios de OpenShift desde el namespace openshift-service-ca. Un atacante con permisos de creación de recursos Hawtio en cualquier namespace puede falsificar certificados de cliente con CN arbitrario, escalando privilegios en clústeres OpenShift. Esta vulnerabilidad afecta directamente a empresas en LATAM que ejecutan plataformas de contenedores en OpenShift.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

Inyección de comandos OS crítica en Cosminexus Component Container (CVE-2026-71376)

Una vulnerabilidad de inyección de comandos del sistema operativo (CVSS 9.8) afecta múltiples versiones de Cosminexus Component Container, permitiendo a atacantes ejecutar comandos arbitrarios con privilegios de la aplicación. La falla impacta versiones desde 11-70-01 hasta 09-80 y anteriores. Empresas en LATAM que usan este middleware de aplicaciones para sistemas críticos deben aplicar parches inmediatamente.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

Vulnerabilidad crítica de inyección de argumentos en Cosminexus Component Container (CVE-2026-71377)

Se ha identificado una vulnerabilidad de inyección de comandos en Cosminexus Component Container con puntuación CVSS 9.8, afectando múltiples versiones desde la 11-70-01 hasta la 09-80. Esta vulnerabilidad permite a atacantes ejecutar comandos arbitrarios en servidores afectados, comprometiendo la integridad y disponibilidad de aplicaciones empresariales críticas. En Latinoamérica, las organizaciones financieras, de telecomunicaciones y sector público que utilizan este componente enfrentan riesgo inmediato de exfiltración de datos y acceso no autorizado.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-62645] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed …

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-50093] A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), S…

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this …

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-71374] Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affec…

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

CVE-2026-68785 Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68785 Microsoft SQL Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

sql-serverrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC