Alertas de Seguridad de la Información

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75697] Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused …

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75698] Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could…

Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75649] Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code…

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75655] Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code ex…

Bridge is affected by an Uncontrolled Recursion vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75658] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75663] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75665] Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code…

Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-75632] CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could…

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-19480] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-34689] Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path T…

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-57149] plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as …

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet (plone.app.portlets.portlets.classic) used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95656] A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects …

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of the file changedetectionio/blueprint/add_watch_ui/__init__.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and coul…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94384] Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principa…

Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization val…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-93345] MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labell…

MikroTik RouterOS before 7.25beta4 contains an improper input validation vulnerability in the labelled-VPN NLRI iterators of the routing service that allows an unauthenticated on-path attacker to crash the BGP service by sending a malformed MP_REACH_NLRI UPDATE message with a prefix-length value below the minimum valid for a labelled-VPN NLRI, which passes validation while describing a route with …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-89275] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-89276] Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injecti…

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-85279] Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack b…

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPluginFromPath in PowerEditor/src/MISC/PluginsManager/PluginsManager.cpp because the plugin-supplied GetLexerCount() result controls a loop that writes to containers[30] without enforcing NB_MAX_EXTERNAL_LANG. A malicious or compromised plugin that reports more …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-85995] Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ update…

Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can accept a modified GUP.exe file whose embedded certificate metadata remains present even though its Authenticode digest is invalid. An attacker who can replace or plant the updater-related file can cause Notepad++ to launch attacker-modified code when a user trig…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-86054] Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack b…

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in NppParameters::writeSession in PowerEditor/src/Parameters.cpp because it copies a session path derived from -settingsDir= into backupPathName[MAX_PATH] with unbounded wcscpy and appends SESSION_BACKUP_EXT with unbounded wcscat. A sufficiently long settings directory causes the back…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-83597] Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent…

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or hijack those visible process windows to execute arbitrary commands with SYSTEM privileges. This issue …

nvdaltovulnerabilidad CVSS 7.0 NVD