Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47031] Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Is…

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47033] Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Int…

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts Integration. While the vulnerability is in Oracle Contracts Integration, attacks may significant…

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47015] Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA …

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). The supported version that is affected is 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and w…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47017] Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Proc…

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker …

nvdaltovulnerabilidad CVSS 8.7 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47019] Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog)…

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access t…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-47014] Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Securit…

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification …

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46998] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person othe…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46989] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platfo…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46924] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46941] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Main…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-46954] Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Remo…

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Data Removal Tool). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources. Successful attacks of this vulnerability can result in takeover of Oracle Human Resources. CVSS 3.…

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-35287] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Testing Suite a…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-35290] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-46876] Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.…

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Int…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46923] Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Su…

Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47237] Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clust…

Kubeflow Community Distribution helps users to install Kubeflow Platform in popular Kubernetes clusters. Prior to version 26.03-rc.1, a Kubeflow setup based on the official manifests or most other packaged Kubeflow distributions is vulnerable to authorization token stealing from any user of the Kubeflow UI or APIs, such as the Dashboard, Pipelines API, or Notebooks. With this token, the attacker c…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47685] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint (`/service/inventory.php`) persists client-supplied values without sanitization, and the Host Management Inventory page renders all static inventory fields into HTML without output encoding, allowing stored cross-site …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47687] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `selectForm()` helper in `fogpage.class.php` renders `` labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address can POST a malicious `sysproduct` value to `/service/inventory.php`, which is stored …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47688] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power mana…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47413] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(wo…

nvdcriticovulnerabilidad CVSS 9.6 NVD