Alertas de Seguridad de la Información

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85434] MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbo…

MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85435] MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on th…

MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages on the vehicle bus, allowing any publisher to enroll attacker-controlled shore routes. Attackers can publish malicious shore route messages to receive bridged vehicle traffic including sensor data and control information.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85436] MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPkt…

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85424] MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated cl…

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85425] MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable…

MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAY_MOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85426] MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names w…

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85427] MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allow…

MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary programs by publishing a crafted MISSION_FILE message to the MOOSDB. Attackers can publish a mission file containing malicious Run entries that pAntler parses and executes via execvp() without authentication validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85428] MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB…

MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated clients to write variables. Attackers can send HTTP requests with variable names and values to the MOOSDB HTTP server port to modify MOOS variables including actuator and override commands without authentication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85429] MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather t…

MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-70178] Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a…

Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-70352] Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to…

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-80098] Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker t…

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-83711] Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an u…

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85225] A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability af…

A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85378] A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is pub…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-62906] Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows…

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-62916] Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorize…

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-65818] Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privil…

Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-69857] Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to…

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85223] A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functio…

A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callback_url/sync_interval results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD