Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105392] A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an …

A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. The impacted element is an unknown function of the file backend/application/settings.py of the component JWT Signing. The manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key . Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The proj…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-94591] Armatura One stores database and message-broker credentials in an install configuration file, encryp…

Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software itself and are identical across every installation. An attacker with a copy of the installation package can recover this key and initialization vector, a…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-82827] Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Ke…

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-47097] AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows una…

AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attackers can reverse engineer the publicly available firmware image to recover the shared passphrase and decrypt diagnostics export bundles retrieve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

Divulgación de información en BVMS 4.5 a 12.3 permite ataques de intermediario

Una vulnerabilidad de divulgación de información afecta BVMS (Bosch Video Management System) versiones 4.5 hasta 12.3. Atacantes en posición de intermediario (MitM) pueden interceptar comunicaciones y obtener acceso no autorizado a datos sensibles. Empresas con sistemas de vigilancia Bosch en México y LATAM deben evaluar su exposición inmediata.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-103055] AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime We…

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE service when the AISOC_REALTIME_JWT_SECRET environment variable is not set. Unauthenticated attackers can forge subscription tickets with arbitrary tenant identifiers to access cross-tenant live alerts, cases, agent events and graph updates through the realtime endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-18181] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-86708] ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of …

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-18154] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-28326] SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execu…

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

Vulnerabilidad alta en Dell OpenManage Server Administrator por clave criptográfica hardcodeada

Dell OpenManage Server Administrator en versiones anteriores a 11.1.0.3 contiene una vulnerabilidad de clave criptográfica hardcodeada (CVSS 8.1) que permite acceso no autenticado remoto. Afecta servidores físicos en centros de datos y entornos empresariales de México y Latinoamérica que utilizan esta herramienta de administración remota. Un atacante remoto podría comprometer sistemas altas de infraestructura sin requerir credenciales.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-81855] A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framew…

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-78225] A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller compo…

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-89026] The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf cont…

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-90945] Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be over…

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90510] A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the func…

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file orion-visor-modules/orion-visor-module-asset/orion-visor-module-asset-service/src/main/java/org/dromara/visor/module/asset/service/impl/HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to b…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

09/09/2026

[CVE-2026-87929] MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config…

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/09/2026

[CVE-2026-53939] OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In ve…

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81821] The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files…

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.

nvdaltovulnerabilidad CVSS 8.4 NVD