Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-12423] A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable …

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-101888] The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability t…

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemChe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79896] Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parse…

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-47360] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97273] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97260] Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97268] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-67105] HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could al…

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-79898] Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user a…

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec r…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56589] HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, whic…

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103687] A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the f…

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102378] Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-79901] In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Dire…

In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows the service principal and can estimate the password-change time can reproduce a limited candidate set and verify candidates offline.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-66246] iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to expl…

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102504] Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_…

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an u…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad XXE alta en Apache Camel Quarkus permite lectura de archivos locales

Apache Camel Quarkus versiones 3.2.0-3.33.2 y 3.34.0-3.39.x contienen una vulnerabilidad de inyección XXE (XML External Entity) en su extensión de soporte XSLT que permite a atacantes leer archivos locales o realizar solicitudes a sistemas internos. Empresas en México y LATAM que usan Camel Quarkus en pipelines de integración de datos quedan expuestas a filtración de credenciales y configuraciones sensibles.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad SSRF alta en Budibase 3.41.0 afecta generación de tablas con IA

Budibase versiones hasta 3.41.0 contiene una vulnerabilidad de Server-Side Request Forgery (SSRF) en la función de generación de tablas con IA. Usuarios autenticados pueden explotar la función uploadUrl en fileUtils.ts para enviar solicitudes a URLs internas, obteniendo acceso a recursos sensibles del servidor. El impacto afecta especialmente a empresas en LATAM que usan Budibase en entornos productivos sin aislamiento de red adecuado.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad de omisión de autorización en Obot 0.21.1 a 0.24.1 (CVE-2026-103758)

Obot versiones 0.21.1 hasta 0.24.1 contienen una vulnerabilidad de omisión de controles de autorización que permite a usuarios autenticados con rol básico acceder a servidores MCP mediante la ruta /mcp-connect-composite/, no incluida en la lista de denegación. Usuarios con IDs MCP compuestos pueden enviar solicitudes proxy a través de mcpGateway.Proxy para invocar herramientas en servidores restringidos, evadiendo reglas de control de acceso.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad alta en Ghost: inyección XLS afecta versiones 0.5.3 a 6.49.x

Ghost (plataforma de blogging y CMS) contiene una falla de sanitización en la etiqueta JSON-LD del helper {{ghost_head}} que permite a usuarios autenticados con permisos limitados inyectar código malicioso. El script se ejecuta en páginas publicadas, poniendo en riesgo las sesiones administrativas de staff cuando visualizan contenido comprometido. Afecta versiones desde 0.5.3 hasta anteriores a 6.50.0.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad alta en Ghost 6.20.0-6.57.0: escalación de privilegios en sesiones de administrador

Ghost versiones 6.20.0 a 6.57.0 contienen un fallo en la gestión de sesiones que permite a usuarios autenticados con credenciales de staff suplantary otros administradores sin necesidad de contraseña, eludiendo autenticación de dos factores. Empresas que alojan plataformas Ghost en LATAM enfrentan riesgo alta de compromiso de cuentas administrativas y acceso no autorizado a funciones sensibles de gestión de contenidos.

nvdaltovulnerabilidad CVSS 8.1 NVD