Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-72843] The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/m…

The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the cust…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-72848] SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documente…

SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py applies the documented restrict_to_same_domain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to self.scrape_all([loc.text], "xml"), which reaches WebBaseLoader.scrape_all and an aiohttp GET, with no dom…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-72860] The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues se…

The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate after a redirect, and its IPv4-mapped IPv6 branch is unreachable. The branch matches ^::ffff:(\d+\.\d+\.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69855] Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to di…

Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69519] Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose infor…

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69543] Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevat…

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-69555] Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a ne…

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69558] Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized …

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-69836] Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute c…

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-69851] Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevat…

Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-69400] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a…

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-69419] Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to exe…

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-68782] Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da…

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-68789] Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Da…

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-66800] Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose…

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-65816] Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevat…

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-66309] Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov…

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-65801] Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to e…

Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-65770] Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed …

Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63509] Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over…

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD