Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta en Dell OpenManage Server Administrator permite ejecución remota sin autenticación

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 presenta una vulnerabilidad de autenticación faltante (CVSS 8.1) que permite a atacantes remotos ejecutar código sin credenciales. Esta falla afecta infraestructuras de servidores en empresas de México y LATAM que utilizan esta herramienta para gestión de sistemas Dell PowerEdge.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-61594] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, na…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92805] UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wiza…

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20343] A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remo…

A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files and use unbounded disk space. This vulnerability exists because a critical API lacks authentication. An attacker could exploit this vulnerability by repeatedly invoking the API. A successful exploit could allow the attacker to download sensitive files …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-20326] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Das…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20326 are related to missing authentication for critical func…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92729] SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytic…

SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92717] Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing …

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92720] Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowi…

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92625] Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. …

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-61590] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigu…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

16/09/2026

CVE-2026-86106: Ejecución remota no autenticada en unidades Edge con Alta Disponibilidad

Una vulnerabilidad crítica (CVSS 9.6) permite a actores no autenticados con acceso a la interconexión privada de HA activar funciones sensibles sin verificación, resultando en ejecución de comandos elevados en unidades Edge donde HA está habilitada. Afecta principalmente a infraestructuras de borde en centros de datos y cloud híbrido en LATAM.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

16/09/2026

XikeStor Layer3: Falla de autenticación en descarga de configuración (CVE-2026-88263)

Los switches Layer3 de XikeStor carecen de validación de autenticación en el servicio de descarga de datos de configuración, permitiendo a atacantes no autenticados recuperar credenciales y configuraciones de red. Esta exposición es alta en entornos corporativos de LATAM que utilizan estos equipos como infraestructura core, riesgando acceso lateral a sistemas internos y uso como puente de salto hacia redes segmentadas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-88065] `tts-be` is a backend for a timetable selector that aims to help students better choose their class …

`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-68070] The affected products are missing authentication for a critical function, which could allow an attac…

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87217] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87184] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Fina…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87188] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Fin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87173] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87175] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-87176] Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Sec…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion…

nvdcriticovulnerabilidad CVSS 9.1 NVD