Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-62834] Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attack…

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76234] libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic i…

libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, contain cryptographic implementation bugs. libcrux-ecdh did not properly check length and clamping during X25519 secret validation (and had a broken clamping check for imported X25519 secret keys); libcrux-ed25519 performed a duplicated clamping step during key generation; and libcrux-psq panicked instead of propagating a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2025-9210] Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions b…

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 6 días

Vulnerabilidad crítica de omisión de autenticación en openssl_encrypt anteriores a v1.4.0

openssl_encrypt versiones previas a 1.4.0 contiene una vulnerabilidad de omisión de autenticación (CVSS 9.8) en pqc.py donde fallos en desencriptación AES-GCM activan una caída no autenticada a modo AES-CTR. Atacantes pueden modificar texto cifrado en tránsito para eludir verificación de integridad y ejecutar ataques de inversión de bits sin detección, comprometiendo confidencialidad e integridad de datos en sistemas financieros, gubernamentales y corporativos de LATAM.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

Vulnerabilidad crítica en openssl_encrypt anteriores a 1.4.0 permite filtración de secretos

openssl_encrypt en versiones anteriores a 1.4.0 contiene una vulnerabilidad (CVSS 9.8) en la función PublicKeyBundle.from_dict() que procesa datos no verificados sin validar firmas criptográficas. Un atacante puede manipular bundles de claves públicas para cifrar datos con claves controladas por el atacante, exponiendo información sensible en bases de datos, sistemas de pago y plataformas cloud comúnmente utilizadas en LATAM.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-18500] @fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verifi…

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.2, a per-request verification key passed to request.jwtVerify({ key }) is silently overridden by the plugin's globally configured secret, because the option merge applies the global key last. Applications that use different keys for different authorization domains, for example separate user and admin keys, therefore accep…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19910] PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnera…

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the application installer. The issue results from the lack of proper …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-28148] Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Unauthenticated Bypass Vulnerability in Headless Single Sign On

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en ManageEngine Password Manager Pro y PAM360 permite eludir autenticación

ManageEngine Password Manager Pro (versiones anteriores a 13232) y PAM360 (versiones anteriores a 8551) presentan una vulnerabilidad de elusión de autenticación (CVSS 8.8) por validación incorrecta de SAML. Esto permite a atacantes acceder a gestores de credenciales sin autenticación válida, comprometiendo todas las contraseñas almacenadas en la solución. Afecta principalmente a empresas medianas y grandes en México y LATAM que utilizan estas herramientas para administración centralizada de accesos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-68759] A holder of a valid integration credential may impersonate other users under specific conditions.

A holder of a valid integration credential may impersonate other users under specific conditions.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-68757] A user with access to a valid SAML response may impersonate another user under specific conditions.

A user with access to a valid SAML response may impersonate another user under specific conditions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15556] A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion …

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62873] Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorize…

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62918] Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker …

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

06/08/2026

Vulnerabilidad crítica CVE-2026-5430 en autenticación JWT permite acceso no autorizado

Múltiples fabricantes han reportado una vulnerabilidad crítica (CVSS 10.0) en mecanismos de autenticación JWT que aceptan tokens firmados con algoritmos no configurados explícitamente. Atacantes pueden falsificar tokens JWT con algoritmos alternativos que son validados incorrectamente, permitiendo acceso no autorizado a sistemas, bases de datos y controles administrativos. Este riesgo es especialmente grave en infraestructuras cloud, plataformas de API y soluciones de identidad ampliamente usadas en LATAM.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-7557] An improper verification of cryptographic signature vulnerability in the SAML authentication module …

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16443] A flaw was found in the SAML metadata import functionality of the keycloak-services component, which…

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an un…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18568] XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify …

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no ele…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-9487] XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml()…

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against w…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18092] Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping…

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //sa…

nvdaltovulnerabilidad CVSS 8.1 NVD