Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35080] The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local f…

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35081] The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processe…

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35082] The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files…

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35083] A remote attacker with user privileges can exploit a stack buffer overflow to gain full system acces…

A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

03/06/2026

[CVE-2026-35075] An unauthenticated remote attacker can recover a default, hard coded password from a firmware image …

An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35076] The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local fi…

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35077] The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local …

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35078] The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local file…

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

03/06/2026

[CVE-2025-14774] Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15655] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15656] Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalati…

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-41032] It is possible for an unauthenticated adjacent attacker to download log files of the controller, whi…

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

03/06/2026

[CVE-2026-47065] ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Pro…

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which perform…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

03/06/2026

[CVE-2025-14772] Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affect…

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

03/06/2026

[CVE-2025-14773] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

nvdaltovulnerabilidad CVSS 8.0 NVD

A Crítico vulnerabilidad

03/06/2026

[CVE-2025-14771] Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue aff…

Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

nvdcriticovulnerabilidad CVSS 9.9 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-4035] A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment v…

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's env…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15654] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affects Prague: from n/a through 2.2.8.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50031] ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intell…

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors comma…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10704] A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulne…

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD