Vulnerabilidades
Resumen — últimos 7 días
Vulnerabilidades nuevas2750▲ 27 respecto a la semana anterior
Críticas / altas1468▲ 334 respecto a la semana anterior
Nueva explotación activa (KEV)7▼ 3 respecto a la semana anterior
Sin puntuar (sin CVSS)85▼ 441 respecto a la semana anterior
9 resultados, ordenados por fecha de publicación (más recientes primero)
| CVE | Estado | Severidad | EPSS | Explotación activa | Tecnologías afectadas | Publicada ▼ | Modificada | Descripción |
|---|---|---|---|---|---|---|---|---|
| Aplazada | Media (4.8) | 0.14% | — | ILM Informatique OpenconcertoAI | 4/5/2026 | 17/6/2026 | Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data. This issue affects OpenConcerto: 1.7.5. | |
| Aplazada | Baja (2.4) | 0.14% | — | ILM Informatique OpenconcertoAI | 4/5/2026 | 17/6/2026 | Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto: 1.7.5. | |
| Analizada | Alta (8.6) | 0.61% | — | Versa-networks Concerto | 21/5/2025 | 25/8/2026 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct host access depending on… | |
| Analizada | Crítica (10) | 45% | — | Versa-networks Concerto | 21/5/2025 | 25/8/2026 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload endpoint can be leveraged for a Time-of-Check to Time-of-Use (TOCTOU) write in combination with a race… | |
| Analizada | Crítica (9.2) | 82% | ⚠ Explotación activa | Versa-networks Concerto | 21/5/2025 | 17/6/2026 | The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is known to affect Concerto… | |
| Modificada | Media (6.1) | 0.92% | — | Concerto-signage Concerto | 19/5/2021 | 17/6/2026 | Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS… | |
| Modificada | Crítica (9.8) | 2.7% | — | Realization Concerto Critical Chain Planner | 12/7/2019 | 17/6/2026 | Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projectname parameter. | |
| Modificada | Media (6.5) | 0.19% | — | Medtronic Mycarelink Monitor 24950 FirmwareMedtronic Mycarelink Monitor 24952 FirmwareMedtronic Carelink Monitor 2490c FirmwareMedtronic Carelink 2090 Firmware+19 | 26/3/2019 | 17/6/2026 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD,… | |
| Modificada | Media (6.5) | 0.90% | — | Medtronic Mycarelink Monitor FirmwareMedtronic Carelink Monitor FirmwareMedtronic Carelink 2090 FirmwareMedtronic Amplia Crt-d Firmware+16 | 25/3/2019 | 17/6/2026 | The Conexus telemetry protocol utilized within Medtronic MyCareLink Monitor versions 24950 and 24952, CareLink Monitor version 2490C, CareLink 2090 Programmer, Amplia CRT-D, Claria CRT-D, Compia CRT-D, Concerto CRT-D, Concerto II CRT-D, Consulta CRT-D, Evera ICD, Maximo II CRT-D and ICD, Mirro ICD, Nayamed ND ICD,… |