Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72537] A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an atta…

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attac…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72693] `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that use…

`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc//fd/0")`. `stat()` on `/proc//fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15562] A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or …

A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15565] A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint witho…

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15555] A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicat…

A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15556] A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion …

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15561] A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and cou…

A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Medio vulnerabilidad

11/08/2026

CVE-2026-63512 Microsoft SharePoint Server Tampering Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-63512 Microsoft SharePoint Server Tampering Vulnerability. Tipo: Manipulación (Tampering).

sharepoint Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-61928 Windows Hello Tampering Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-61928 Windows Hello Tampering Vulnerability. Tipo: Manipulación (Tampering).

windows Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-62702 Windows Graphics Kernel Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62702 Windows Graphics Kernel Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

windowsdos Microsoft MSRC

M Crítico vulnerabilidad

11/08/2026

CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-62750 Windows HTTP Protocol Stack Tampering Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62750 Windows HTTP Protocol Stack Tampering Vulnerability. Tipo: Manipulación (Tampering).

windows Microsoft MSRC

R Medio vulnerabilidad

11/08/2026

CVE-2026-62912 Microsoft Exchange Server Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-62912 Microsoft Exchange Server Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

exchangedos Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-65785 Windows DHCP Client Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-65785 Windows DHCP Client Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

windowsdos Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68819 Windows Network File System Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68819 Windows Network File System Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

windowsdos Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-72971 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-72971 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability. Tipo: Manipulación (Tampering).

windows Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

[CVE-2026-4757] A VAPIX API parameter had improper input validation which could allow code execution and potentially…

A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72914] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72910] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/pu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72911] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inje…

nvdcriticovulnerabilidad CVSS 9.9 NVD