Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77051] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-77181] Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update…

Incorrect Authorization vulnerability in Apache Syncope. An administrator with ClientApp's update entitlement is unable to perform the related operation, while ClientApp's create entitlement is checked both for create and update operations on ClientApp. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are reco…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-78299] In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS p…

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73178] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An admi…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: fr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-73470] Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or up…

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was granted for. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to ve…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-73579] Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into…

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important component of such transformation is the Realms filter, which ensures that the search results are matching the requester's permissions. For non-recursive search requests it is possible th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-73668] Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitle…

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, scoped in another Realm and thus be able to effectively duplicate such Connector instance into the Realm they have administration rights for. This issue affects Apache Syncope: fr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-75030] Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entit…

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2024-58383] Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf…

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad SSRF alta en Taisan Tarzan-CMS 1.0.0 permite acceso no autorizado

Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en la función openConnection del componente Theme Download Function de Taisan Tarzan-cms versión 1.0.0. Un atacante remoto puede manipular el parámetro httpUrl para ejecutar solicitudes HTTP no autorizadas desde el servidor afectado, comprometiendo la integridad de sistemas internos y datos sensibles. El exploit está disponible públicamente, incrementando el riesgo de explotación inmediata en entornos empresariales de LATAM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

14/09/2026

Vulnerabilidad crítica de ejecución remota de código en LightLLM hasta versión 1.2.0

LightLLM versiones anteriores a 1.2.1 contiene una vulnerabilidad de ejecución remota de código (RCE) en el endpoint WebSocket /visual_register del Config Server sin autenticación. Un atacante con acceso a la red puede enviar un payload malicioso serializado con método __reduce__ a pickle.loads() para ejecutar código arbitrario con privilegios del proceso Config Server. Este riesgo afecta directamente a infraestructuras de IA/ML en empresas de México y LATAM que ejecuten LightLLM en entornos de producción o desarrollo expuestos a la red interna o internet.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

Vulnerabilidad crítica en Bifrost permite ejecución remota de código sin autenticación

Bifrost permite registrar clientes MCP a través de su API de gestión sin requerir handshake MCP ni autenticación cuando governance.auth_config.is_enabled=false (configuración por defecto). Un atacante puede ejecutar comandos arbitrarios como el usuario del proceso Bifrost mediante una única solicitud POST /api/mcp/client no autenticada, comprometiendo completamente servidores y gateways en empresas de LATAM que usen esta solución.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad alta de Use After Free en Open5GS 2.7.x y anteriores

Se descubrió un fallo de seguridad (CVE-2026-90707, CVSS 8.3) en Open5GS que afecta la función amf_nnrf_try_old_amf_discovery_fallback, permitiendo ataques remotos de Use After Free mediante manipulación del parámetro discovery_option. Este componente es alta en infraestructuras 5G, poniendo en riesgo operadores de telecomunicaciones y proveedores de servicios móviles en LATAM que dependan de esta solución open source.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/09/2026

Inyección SQL alta en Yot CMS hasta versión 3.3.1 — CVE-2026-90708

Se identificó una vulnerabilidad de inyección SQL en el manejador de cookies de Yot CMS versión 3.3.1 y anteriores. El parámetro yot3_user/yot3_pass en la función Login del archivo global.php permite ataques remotos sin autenticación. El exploit público incrementa el riesgo para sitios web y portales corporativos en LATAM que usan esta plataforma.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad de escalación de privilegios en Mattermost permite acceso no autorizado a canales restringidos

Mattermost versiones 11.9.0, 11.8.4, 11.7.7 y 10.11.22 o anteriores presentan una falla en la validación de permisos de gestión de miembros de canal durante la creación de ejecuciones de playbooks. Un miembro autenticado del canal puede adicionar usuarios arbitrarios a canales restringidos mediante el campo propietario de la ejecución. Esta vulnerabilidad (MMSA-2026-00677, CVSS 7.1) afecta principalmente a organizaciones en LATAM que utilizan Mattermost como plataforma de colaboración interna con canales de acceso controlado.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad alta de inyección SQL en EFence de Thinking Software Technology (CVSS 7.5)

EFence, producto de Thinking Software Technology, contiene una vulnerabilidad de inyección SQL que permite a atacantes no autenticados ejecutar comandos SQL arbitrarios y acceder al contenido de bases de datos. Esta falla expone sistemas de gestión de datos en empresas de LATAM sin requerir credenciales previas, comprometiendo la confidencialidad de información sensible. El riesgo es elevado en organizaciones que utilizan EFence en producción con acceso remoto.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-82232] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort clauses for Task search. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-86460] Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search condi…

Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-87779] Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of…

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes) is configured, Syncope will pad the provided value with random characters. The resulting key value is logged. This issue affects Apache Syncope: from 3.0.15 through 3.0.16, from 4.0.3 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-87785] Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS setti…

Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4…

nvdcriticovulnerabilidad CVSS 9.1 NVD