Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80164] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

05/09/2026

Vulnerabilidad alta en Bilibili Desktop: desactivación de verificación TLS y ejecución de código remoto

Bilibili Desktop versión 1.18.0 y anteriores desactiva la verificación de certificados TLS a nivel de proceso y ejecuta configuraciones JavaScript sin firma desde servidores remotos. Un atacante en posición de intermediario de red puede interceptar descargas de configuración, inyectar código JavaScript malicioso con acceso al puente IPC privilegiado, permitiendo ejecución de comandos del sistema y robo de credenciales de sesión.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84961] undici's BalancedPool constructor passes its entire options object through an internal deep-clone th…

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer who…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85525] Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a r…

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage ho…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

29/08/2026

Vulnerabilidad alta de intercepción de tráfico en BOSH Director vCenter CPI (CVE-2026-41012)

Una vulnerabilidad de intercepción de tráfico en BOSH Director vCenter CPI permite a atacantes posicionados entre el Director y vCenter suplantar la API REST de vCenter y capturar credenciales de administrador mediante autenticación HTTP Basic. Un atacante con capacidad de interceptar tráfico puede comprometer completamente la infraestructura de virtualización. En LATAM, esto afecta altas centros de datos y plataformas de IaaS que dependen de vCenter para gestión de máquinas virtuales.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

28/08/2026

Vulnerabilidad en mongosqld: certificados de cliente no validados correctamente

mongosqld no valida correctamente los certificados de cliente durante el handshake TLS cuando está configurado con una autoridad certificadora. Esto permite que clientes sin certificado establezcan sesiones, comprometiendo la autenticación en entornos que dependen exclusivamente de certificados para identificar usuarios. Empresas en LATAM que utilizan MongoDB BI Connector con autenticación basada en certificados están expuestas a acceso no autorizado.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55215] MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL …

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate fingerprint validation. In lib/cmd/handshake/auth/handshake.js, a server that selects mysql_clear_password as…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-18717] ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which m…

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65084] NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker coul…

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, code execution, and escalation of privileges.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-17024] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76403] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network …

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate valid…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76362] In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffi…

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-16822] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC p…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-16835] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and …

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-49283] The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions …

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response rec…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-15078] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-52723] ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to …

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration performs VAU server certificate validation in app/vau/VAUProtokoll.py without anchoring the signed_vau_server_pub_keys and AUT_VAU_CertData certificate path to independent trusted material. A network-positioned attacker between…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50578] ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to …

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disables TLS certificate verification for both ePA connections in app/vau/VAUProtokoll.py and Konnektor connections in app/konnektor/Konnektor.py. A network-positioned attacker can present an arbitrary certificate, terminate th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-59825] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq backgro…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-66795] A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto…

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allows a privileged service account on a spoke cluster to submit a malicious CSR. Successful exploitation can lead to privilege escalation, enab…

nvdcriticovulnerabilidad CVSS 9.1 NVD