Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-73926] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impa…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-73458] On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD)…

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-71133] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impa…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-71163] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-69203] Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with …

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS for peer-created streams. One unauthenticated connection can open an unbounded number of streams, each retaining per-stream state until heap exhaustion. The same unchecked allocation is reachable in an ember-client thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-69205] Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse…

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values such as Chunked are not recognized, values such as notchunked are incorrectly accepted, and Unicode case folding can turn a Kelvin-sign byte sequence into a match …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-69202] Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-c…

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received from the network rather than bytes consumed by the application, while each stream stores DATA in an unbounded channel. A hostile peer can therefore send a body faster than a slow or non-draining application consumes it, retaining payloads in h…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-57014] In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds wri…

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-88765] GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before …

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-61667] DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0…

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query ca…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-61668] DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0…

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacke…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-54547] Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to…

Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A network caller using the stre…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-45579] DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0…

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12358] IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insuffi…

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12666] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12667] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-12150] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker with a trusted TLS client certificate to cause a denial of service and potentially affect memory contents due to improper validation of deeply nested certificate data during …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11934] IBM Verify Identity Access could allow an administrator to execute additional commands they are not …

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11728] IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3…

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow a remote attacker to cause a denial of service or potentially execute arbitrary code in the client due to a heap buffer overflow when receiving messages from a malicious queue manager or throu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11926] IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insuffi…

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

nvdaltovulnerabilidad CVSS 7.5 NVD