Radar de Seguridad

CVE-2026-97229 Crítica · CVSS 10.0 en el catálogo el 29/10/2026

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab · Community Edition and Enterprise Edition · CWE-190

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation. EN

CVE-2026-48356 Crítica · CVSS 9.3 en el catálogo el 27/10/2026

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe · Commerce and Magento · CWE-434

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. EN

CVE-2026-111497 Crítica · CVSS 9.2 en el catálogo el 27/10/2026

Google Brotli Unchecked Return Value Vulnerability

Google · Brotli · CWE-252, CWE-787

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. EN

CVE-2026-109619 Crítica · CVSS 9.2 en el catálogo el 26/10/2026

PHP Stale Internal Request-State Vulnerability

PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution. EN

CVE-2026-109618 Crítica · CVSS 9.2 en el catálogo el 26/10/2026

PHP Memory Corruption Vulnerability

PHP Group · PHP · CWE-416, CWE-755, CWE-824, CWE-1325, CWE-1419

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution. EN

CVE-2026-114625 Crítica · CVSS 9.4 en el catálogo el 23/10/2026

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista · VeloCloud Orchestrator · CWE-89

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. EN

CVE-2026-110447 Crítica · CVSS 9.2 en el catálogo el 23/10/2026

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora · Collabora Online – Built-in CODE Server · CWE-78

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running. EN

CVE-2026-102764 Crítica · CVSS 9.3 en el catálogo el 16/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

BeyondTrust · Remote Support · CWE-290

BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. EN

CVE-2026-21589 Crítica · CVSS 9.3 en el catálogo el 15/10/2026

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Atlassian · Multiple Products · CWE-552

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions. EN

CVE-2026-105134 Crítica · CVSS 10.0 en el catálogo el 14/10/2026

Ahsay AhsayCBS Command Injection Vulnerability

Ahsay · AhsayCBS · CWE-77, CWE-78

Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133. EN

CVE-2026-76519 Crítica · CVSS 9.8 en el catálogo el 14/10/2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

Cisco · Secure Email Gateway · CWE-23

Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. EN

CVE-2015-3306 Crítica · CVSS 10.0 en el catálogo el 08/10/2026

ProFTPD Improper Access Control Vulnerability

ProFTPD · ProFTPD · CWE-284

ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. EN

CVE-2021-3199 Crítica · CVSS 9.8 en el catálogo el 08/10/2026

ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE · Docs · CWE-22

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution. EN

CVE-2026-102490 Crítica · CVSS 9.4 en el catálogo el 02/10/2026

Zammad GmbH Zammad Improper Privilege Management Vulnerability

Zammad GmbH · Zammad · CWE-269

Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489. EN

CVE-2026-102489 Crítica · CVSS 9.4 en el catálogo el 02/10/2026

Zammad GmbH Zammad Session Fixation Vulnerability

Zammad GmbH · Zammad · CWE-384

Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490. EN

CVE-2026-104286 Crítica · CVSS 9.8 en el catálogo el 01/10/2026

Fortinet FortiMail Path Traversal Vulnerability

Fortinet · FortiMail · CWE-22, CWE-158

Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests. EN

CVE-2026-76504 Crítica · CVSS 9.8 en el catálogo el 30/09/2026

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

Cisco · Catalyst SD-WAN Manager · CWE-177

Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper handling of URI encoding in an HTTP request. EN

CVE-2026-88772 Crítica · CVSS 9.5 en el catálogo el 27/09/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix · NetScaler · CWE-119

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service EN

CVE-2026-88771 Crítica · CVSS 9.5 en el catálogo el 27/09/2026

Citrix NetScaler Improper Input Validation Vulnerability

Citrix · NetScaler · CWE-119

Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands. EN

CVE-2026-5430 Crítica · CVSS 10.0 en el catálogo el 24/09/2026

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 · Multiple Products · CWE-347

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. EN

CVE-2026-71362 Crítica · CVSS 9.1 en el catálogo el 24/09/2026

Adobe Commerce and Magento Incorrect Authorization Vulnerability

Adobe · Commerce and Magento · CWE-863

Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. EN

CVE-2026-93616 Crítica · CVSS 9.8 en el catálogo el 22/09/2026

Check Point Multiple Products Path Traversal Vulnerability

Check Point · Multiple Products · CWE-22

Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. EN

CVE-2026-85102 Crítica · CVSS 9.8 en el catálogo el 22/09/2026

Check Point Multiple Products Improper Certificate Validation Vulnerability

Check Point · Multiple Products · CWE-295

Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. EN

CVE-2026-93952 Crítica · CVSS 9.5 en el catálogo el 22/09/2026

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Arista · VeloCloud Orchestrator · CWE-20

Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. EN