Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81302] PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a loc…

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85197] A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can ex…

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in informat…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85085] The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView…

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85094] The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin ru…

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81270] Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: t…

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-62928] XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injec…

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-66840] XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sp…

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-69657] XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the cr…

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-70403] XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the …

XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-16281] The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can ed…

The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19224] The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting…

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

nvdaltovulnerabilidad CVSS 7.2 NVD

? Crítico alerta

04/09/2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog. CVEs relacionados: CVE-2026-85046.

cisaus-certalerta CISA KEV

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85504] FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long…

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85505] ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_en…

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-11613] The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up t…

The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_loop_template' parameter parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensit…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85403] A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknow…

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85148] SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Un…

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85398] A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the fun…

A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85399] A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by th…

A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85402] A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affe…

A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD