Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2687▼ 562 respecto a la semana anterior
Críticas / altas1259▼ 239 respecto a la semana anterior
Nueva explotación activa (KEV)4▼ 5 respecto a la semana anterior
Sin puntuar (sin CVSS)265▼ 239 respecto a la semana anterior
11.347 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Pendiente de análisis | Alta (8.6) | 0.40% | — | Cisco Secure Firewall Adaptive Security Appliance ASA SoftwareAICisco Secure Firewall Threat Defense FTD SoftwareAI | 16/9/2026 | 18/9/2026 | A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload… | |
| Pendiente de análisis | Media (6.8) | 0.34% | — | Cisco Secure Firewall Adaptive Security ApplianceAICisco Secure Firewall Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the TCP DNS response handler to unexpectedly restart, causing the device to… | |
| Pendiente de análisis | Alta (7.4) | 0.17% | — | Cisco Secure Firewall Adaptive Security ApplianceAICisco Secure Firewall Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the EIGRP implementation in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This… | |
| Pendiente de análisis | Alta (8.6) | 0.40% | — | Cisco Secure Firewall Adaptive Security ApplianceAICisco Secure Firewall Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause high CPU utilization on an affected device, resulting in a… | |
| Pendiente de análisis | Alta (8.6) | 0.46% | — | Cisco Secure Firewall Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the TLS 1.3 implementation in Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to improper buffer management during the… | |
| Pendiente de análisis | Media (5.3) | 0.49% | — | Cisco Adaptive Security ApplianceAICisco Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls. This vulnerability… | |
| Pendiente de análisis | Media (5.8) | 0.41% | — | Cisco Secure Firewall Adaptive Security ApplianceAICisco Secure Firewall Threat DefenseAI | 16/9/2026 | 18/9/2026 | A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured access controls. This vulnerability… | |
| Pendiente de análisis | Crítica (9.9) | 0.34% | — | Cisco Secure Adaptive Security Appliance SoftwareAICisco Secure Firewall Threat Defense SoftwareAICisco Secure Firewall Management Center SoftwareAI | 16/9/2026 | 18/9/2026 | The vulnerabilities tracked by CVE-2026-20330 are related to improper neutralization issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707. | |
| Pendiente de análisis | Crítica (9.9) | 0.45% | — | Cisco Secure Adaptive Security Appliance SoftwareAICisco Secure Firewall Threat Defense SoftwareAICisco Secure Firewall Management Center SoftwareAI | 16/9/2026 | 18/9/2026 | The vulnerabilities tracked by CVE-2026-20329 are related to issues concerning improper handling of exceptional conditions that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-703. | |
| Pendiente de análisis | Crítica (9.6) | 0.23% | — | Cisco Secure Adaptive Security Appliance SoftwareAICisco Secure Firewall Threat Defense SoftwareAICisco Secure Firewall Management Center SoftwareAI | 16/9/2026 | 18/9/2026 | The vulnerabilities tracked by CVE-2026-20331 are related to the failure of protection mechanisms issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-693. | |
| Pendiente de análisis | Alta (8.8) | 0.08% | — | Crowdstrike Falcon SensorAICrowdstrike Laroux Malware Cleanup ToolAIMicrosoft OfficeAI | 15/9/2026 | 18/9/2026 | CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings.… | |
| Pendiente de análisis | Media (6.9) | 0.26% | — | Nginx PlusAINginx Open SourceAIOpensslAI | 15/9/2026 | 18/9/2026 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the… | |
| Aplazada | Alta (7.5) | 0.65% | — | GeolensAI | 15/9/2026 | 30/9/2026 | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer, VRT… | |
| Aplazada | Alta (7) | 0.14% | — | Wso2 Integrator MI VS Code ExtensionAI | 15/9/2026 | 18/9/2026 | The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful… | |
| Aplazada | Media (5.5) | 0.43% | — | Phpgurukul Daily Expense Tracker SystemAI | 15/9/2026 | 15/9/2026 | A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public… | |
| Aplazada | Baja (2) | 0.35% | — | Phpgurukul Daily Expense Tracker SystemAI | 15/9/2026 | 15/9/2026 | A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be… | |
| Aplazada | Media (5.5) | 0.43% | — | Phpgurukul Daily Expense Tracker SystemAI | 15/9/2026 | 15/9/2026 | A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and… | |
| Pendiente de análisis | Media (6.2) | 0.12% | — | IBM Common Licensing AgentAIIBM ARTAI | 14/9/2026 | 16/9/2026 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. An attacker can modify requests to bypass validation controls and submit unauthorized values,… | |
| Analizada | Media (5.5) | 0.16% | — | Fedoraproject SssdRedhat Openshift Container PlatformRedhat Enterprise Linux | 14/9/2026 | 7/10/2026 | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability… | |
| Pendiente de análisis | Alta (7) | 0.45% | — | Openstack GlanceAI | 14/9/2026 | 22/9/2026 | In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the web-download import path, the location API only checks the URL scheme and does not apply the import_filtering_opts host restrictions. An authenticated user can add a location… | |
| Aplazada | Media (5.5) | 2.1% | — | Gh05tcrew PenstetagentAI | 14/9/2026 | 15/9/2026 | A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Performing a manipulation results in os command injection. The attack is possible to be carried out… | |
| Aplazada | Media (5.3) | 0.43% | — | Tensoropera FedmlAI | 14/9/2026 | 14/9/2026 | A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote… | |
| Aplazada | Media (5.3) | 0.40% | — | Openstatushq OpenstatusAI | 12/9/2026 | 15/9/2026 | A vulnerability has been found in openstatusHQ openstatus up to f04c827112f30a11d571ebdad3892826034d6265. Affected by this vulnerability is an unknown functionality of the file apps/status-page/src/lib/proxy/resolve-custom-domain-rewrite.ts. The manipulation leads to server-side request forgery. The attack may be… | |
| Pendiente de análisis | Media (6.3) | 0.33% | — | Openstack IronicAI | 11/9/2026 | 22/9/2026 | OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is configured for HTTP(S) Basic Authentication. | |
| Pendiente de análisis | Alta (7.6) | 0.55% | — | Openstack KeystoneAI | 11/9/2026 | 22/9/2026 | An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can… |