Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102245] A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknow…

A weakness has been identified in MODSetter SurfSense up to 2.0.3. The affected element is an unknown function of the file surfsense_backend/app/routes/circleback_webhook_route.py of the component circleback Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102243] A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown p…

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosu…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102240] A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the…

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not res…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-96326] The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to S…

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101860] A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the functio…

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101878] Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUs…

Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored procedure as NVARCHAR(50) while the column it queries stores NVARCHAR(300), silently truncating the SSO login identifier on SQL Server deployments and allowing a user whose identity-provider identifier begins with another organization member's full 50-character iden…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101354] A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the fun…

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101280] A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the functi…

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected is the function opendmarc_policy_query_dmarc of the component Multi-Record Set Handler. The manipulation results in authentication bypass by spoofing. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101281] A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerabilit…

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_sp2_find_mailfrom_domain of the file libopendmarc/opendmarc_spf.c of the component SPF Macro Handler. This manipulation causes improper authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: c48a74c75…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102361] mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoi…

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling account takeover and access to orders and personal data.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101264] A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the…

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101263] A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing …

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-102335] Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, al…

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101261] A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/Z…

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101262] A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown cod…

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-102334] Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthe…

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa to gain full session access and administrative control.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101260] A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown f…

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-102281] Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0…

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.2.4 and 12.0.2, a single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport. ServerTCP#handleMessage and ServerRMQ#handleMessage pass a client-controlled non-string pattern to JSON.stringify to derive the handler lookup key; sufficiently de…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101188] A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects …

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101091] SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks e…

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with non-read-only SQL statements that execute automatically during background indexing, rendering, or export operations without authentication.

nvdaltovulnerabilidad CVSS 7.1 NVD