Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-68954] The "pattern" parameter used in search function in the home page of the TMS application is vulnerabl…

The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-68068] The "screenID" parameter in the electronic transaction queue viewer feature within the manual transa…

The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-63713] The "search" parameter in the view audit logs feature within the utilities section is susceptible to…

The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-94204] The central cloud storage backend for the entire dashcam platform is misconfigured with public-read …

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-96587] The Viidure Android application embeds permanent, plaintext cloud storage credentials within its com…

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102925] virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the genera…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish scrip…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102253] iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated…

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-96274] In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink mess…

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-79538] metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP i…

metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76721] Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that cou…

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76722] Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant…

Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76723] Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS tha…

Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76724] A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that c…

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-76725] A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that c…

A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76726] An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow …

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to restricted networks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76727] Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that …

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76728] A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated re…

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-61519] Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user h…

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can sen…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-39117] An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allow…

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-53988] Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints …

Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, …

nvdcriticovulnerabilidad CVSS 10.0 NVD