Alertas de Seguridad de la Información

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-101084] obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allo…

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101062] Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=tr…

Obot before v0.23.0 (affected versions

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101064] Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server regist…

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100875] A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromfaculty.php. Such manipulation of the argument myfid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling relea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100874] A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3…

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file addnewstudent.php. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific ve…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101059] utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specification…

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL va…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101060] python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommuni…

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and ret…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101044] pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.…

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101045] Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metada…

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hos…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101043] pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable pla…

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as alrea…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-101032] navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into …

navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names in suggestion command directories to execute arbitrary commands with victim privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100870] Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-res…

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100871] Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identif…

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100872] Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, …

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/09/2026

Inyección Eval crítica en hMailServer 6.0.0-6.3.3 permite ejecución remota de código

Una vulnerabilidad crítica (CVSS 9.8) en el despachador de scripts JScript de hMailServer permite a atacantes no autenticados ejecutar código arbitrario con privilegios de servicio. La falla se activa mediante contraseñas manipuladas con secuencias de escape en autenticación SMTP, POP3 e IMAP. Afecta principalmente a servidores de correo en Windows en organizaciones de México y LATAM que usen versiones 6.0.0 a 6.3.3.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-96896] The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perfor…

The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's shared filesystem, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-86609] The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted throu…

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators. This affects the commercial Pro edition only; the free Download Manager WordPress plugin befor…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-81655] The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its set…

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to store code which is then executed as PHP or served unescaped to site visitors.

nvdaltovulnerabilidad CVSS 7.5 NVD

? Crítico alerta

27/09/2026

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Two Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-88771, CVE-2026-88772.

cisaus-certalerta CISA KEV

? Crítico alerta

27/09/2026

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

CISA emite alerta de seguridad: Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway. CVEs relacionados: CVE-2026-88771, CVE-2026-88772, CVE-2026-88773, CVE-2026-88774, CVE-2026-88775.

cisaus-certalerta CISA KEV