Alertas de Seguridad de la Información

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-93291] Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-m…

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-79766] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-93425] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoD…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-97359] HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload h…

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to exe…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-19072] Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the …

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiled_collector_args" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of "investigator" ) to set the compiled VQL statements for the hun…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica en D-Link DIR-825 permite escritura fuera de límites

Se identificó una vulnerabilidad de severidad crítica (CVSS 9.8) en el enrutador D-Link DIR-825 versión 3.00b32, específicamente en la función tunnel_set_params del componente rp-l2tp. Un atacante remoto puede explotar el parámetro peer_hostname para ejecutar escritura fuera de límites de memoria, comprometiendo la integridad del dispositivo. Esta vulnerabilidad afecta principalmente infraestructuras de pequeñas y medianas empresas en LATAM que utilizan este modelo como gateway de acceso.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de escalada de privilegios en plugin Paytium para WordPress

El plugin 'Paytium: Mollie payment forms & donations' para WordPress contiene una vulnerabilidad de escalada de privilegios (CVSS 9.8) en versiones hasta 5.0.3 que permite a atacantes eludir mecanismos de validación de firmas y obtener privilegios administrativos. Afecta directamente a tiendas de e-commerce, plataformas de donaciones y sistemas de pago integrados con Mollie en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-84719] A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplat…

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permiss…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-75884] A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist th…

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-84474] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-c…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is exposed to users holding only the read-level view_jobtemplate permission -- both in the job template API representation and in the activity stream -- and the provisioning callback endpoint trusts a client-supplied X-Forwarded-For header to determine the calling ho…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-77602] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through Config…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96759] orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanSta…

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96755] orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect gen…

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-85724] Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are config…

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write acce…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96276] If a malicious SDK container declares an extension point with a crafted `directory` path, and a deve…

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-59167] SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. P…

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handl…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86246] Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled …

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are r…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-82331] Improper link resolution before file access ('link following') vulnerability in the `tar` source plu…

Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStream, via symlinks as part of source fetching. The impact of this issue is mitigated by: * BuildStream projects should only use trusted sour…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-82843] The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID …

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-96257] A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function…

A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD