Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/09/2026

[CVE-2026-72708] SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitem…

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the public sitemap endpoint where the MySQL escaper spip_mysql_cite() in ecrire/req/mysql.php returns values unescaped when the target column is a date type and the supplied value matches the pattern of a word character followed by an open parenthesis. Attackers can supply a crafted value such as a time-based paylo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89260] MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback …

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter ent…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89262] MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint…

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UIDs obtained from unauthenticated listing endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89065] Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 m…

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89066] Improper neutralization of special elements used in an OS command in the task synthesis component in…

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To rem…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89013] Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthentica…

Dolibarr 23.0.4 before 24.0.1 ontains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with hashp=shared to skip token validation while satisfying the authorization condition in htdocs/document.php and htdocs/viewimage.php, gaining acc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-7863] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software allows OS Command Injection. This issue affects Pardus Software: before 1.0.5.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-68497] jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGrego…

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and n…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-8301] Improper neutralization of special elements used in an OS command ('OS command injection') vulnerabi…

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: before 1.0.8.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-8303] Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Instit…

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Escalation. This issue affects Pardus-software: before 1.0.5.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-89009] WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header wit…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-89010] WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string vi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-82578] When XML batch processing is turned on and the XPath option is selected, the raw batch input goes th…

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-82583] NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute ar…

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-87020] An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds w…

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78224] The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, …

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38056] A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmwar…

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured l…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38058] The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, i…

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89212] A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references we…

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-71416] Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, th…

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket …

nvdaltovulnerabilidad CVSS 8.8 NVD