Alertas de Seguridad de la Información

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-56154] Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:.…

Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56449] Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response …

Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-48005] Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server be…

Missing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause a denial of service (forced re-authentication) via forged Authorization headers when Digest authentication is enabled with AuthDigestNcCheck . Users are recommended to upgrade to version 2.4.69, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-46729] NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener…

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-47360] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad XXE alta en Apache Camel Quarkus permite lectura de archivos locales

Apache Camel Quarkus versiones 3.2.0-3.33.2 y 3.34.0-3.39.x contienen una vulnerabilidad de inyección XXE (XML External Entity) en su extensión de soporte XSLT que permite a atacantes leer archivos locales o realizar solicitudes a sistemas internos. Empresas en México y LATAM que usan Camel Quarkus en pipelines de integración de datos quedan expuestas a filtración de credenciales y configuraciones sensibles.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

30/09/2026

[CVE-2026-88920] An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote…

An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-85532] Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. T…

Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or excessive CPU and memory consumption when processing crafted WS-Security messages. The fixes enforce a minimum key length of 16 bytes, a maximum length of 512 bytes, and a maximum offset of 4096 bytes. Users are recommended to upgrade to versions 4.0.2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/09/2026

Omisión de validación en Apache MINA SSHD permite eludir autenticación LDAP

Apache MINA SSHD versiones 1.2.0 a 2.19.0 y 3.0.0-M1 a 3.0.0-M5 contienen una falla en LdapPasswordAuthenticator que permite bypass de autenticación. Afecta servidores SSH en Java que integren LDAP para validación de credenciales, comprometiendo el acceso a sistemas críticos de infraestructura en organizaciones latinoamericanas.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

Bypass de autenticación por inyección LDAP en Apache MINA SSHD afecta múltiples versiones

Apache MINA SSHD, biblioteca Java para SSH, contiene una vulnerabilidad crítica (CVSS 9.1) en su componente opcional sshd-ldap que permite eludir autenticación mediante inyección LDAP. Las versiones afectadas incluyen 1.2.0 a 2.19.0 y 3.0.0-M1 a 3.0.0-M5. Empresas en LATAM que integren LDAP para autenticación SSH en servidores están expuestas a acceso no autorizado.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/09/2026

Omisión de autenticación en Apache MINA SSHD 2.0.0 a 3.0.0-M5 (CVE-2026-77185)

Apache MINA SSHD, librería Java para implementar servidores SSH, contiene una vulnerabilidad crítica (CVSS 9.1) que permite eludir la autenticación en configuraciones específicas de autenticación asincrónica. Afecta principalmente a servidores SSH personalizados en entornos de infraestructura crítica, plataformas de acceso remoto y soluciones de integración en LATAM. La explotación podría comprometer la integridad de sistemas de gestión de infraestructura, bases de datos y servidores de aplicaciones.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

30/09/2026

Vulnerabilidad en Apache MINA SSHD permite eludir autenticación multifactor SSH

Apache MINA SSHD, librería Java para SSH cliente-servidor, presenta una vulnerabilidad alta (CVSS 8.1) que permite eludir esquemas de autenticación multifactor configurados en servidores SSH. Afecta principalmente a infraestructuras Java en LATAM que implementan autenticación de múltiples claves públicas. La falla compromete sistemas de acceso remoto en empresas, data centers y plataformas en la nube que dependen de esta librería.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/09/2026

Agotamiento de memoria en clientes SFTP de Apache MINA SSHD (CVE-2026-94002)

Apache MINA SSHD versiones 0.9.0 a 2.19.0 y 3.0.0-M1 a 3.0.0-M5 contienen una vulnerabilidad de agotamiento de memoria en el componente sshd-sftp. El cliente SFTP (DefaultSftpClient) no valida que las respuestas recibidas correspondan a solicitudes legítimas, permitiendo consumo excesivo de recursos. Afecta a aplicaciones Java que utilizan esta biblioteca para transferencia de archivos segura.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102495] Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious …

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102496] Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema …

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102497] The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitutio…

The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101292] Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStrea…

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class n…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82383] Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote…

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any installed instance, because the setup action remains anonymously reachable after installation and persists configuration without an authorization check. No optional feature or non-default confi…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-82384] Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker t…

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82386] Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog adminis…

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator boo…

nvdaltovulnerabilidad CVSS 7.7 NVD