Alertas de Seguridad de la Información

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46983] Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component:…

Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affected is 16.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Integration Bus. Successful attacks of this vulnerability can result in takeover of Oracle Retail Integration B…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46987] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise M…

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46988] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in take…

nvdaltovulnerabilidad CVSS 7.2 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46924] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46941] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Main…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46943] Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Pl…

Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail EFTLink. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modificati…

nvdaltovulnerabilidad CVSS 7.4 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46954] Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Remo…

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in takeover of Oracle Human Resources. CVSS 3.…

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-35287] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite a…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-35290] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46876] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Int…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46923] Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Su…

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47405] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged workspace-management routes using the shared dependency `require_workspace_member(...)` without requiring `admin`…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47399] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to versio…

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern appears in workspa…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47396] PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a …

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when `CALL_SERVER_TOKEN` is not configured. The affected component is the `praisonai.api.agent_invoke` router as mounted by `praisonai.api.call`. The authentication helper `verify_token()` fails open when `CALL_SERVER_TOKEN` is unset. Since eve…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28321] SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary fi…

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28304] SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can all…

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28306] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28307] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user grou…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16447] A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2025-66390] In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Ba…

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which st…

nvdcriticovulnerabilidad CVSS 9.8 NVD