Resumen Semanal

Resumen semanal de ciberseguridad — 2026-10-12 a 2026-10-19

  • [CVE] CVE-2026-112025 — A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930.
  • [CVE] CVE-2026-112044 — A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29.
  • [CVE] CVE-2026-112082: Denegación de servicio en SGLang — Una vulnerabilidad en SGLang hasta la versión 0.5.19 permite ejecutar ataques remotos de denegación de servicio (DoS) mediante la manipulación del com
  • [CVE] CVE-2026-16460 — A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the curre
  • [CVE] CVE-2026-16487 — A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply u
  • [ransomware] Helix reivindica ataque a American Campus — American Campus records. Yearly revenue ~$1 billion yearly. GoFile links and passwords unlock in 6 hours.
  • [ransomware] N0n reivindica ataque a Company #93 — El grupo de ransomware N0n publicó a un proveedor de servicios de salud estadounidense como víctima pendiente de filtración, sin revelar su identidad.
  • [ransomware] N0n reivindica ataque a Finzly Corp — fintech payments · US | Network configuration and access secrets for payment infrastructure; Cloud environment topology and access keys | [NOT PAID —
  • [ransomware] Storm reivindica ataque a Baltimore Tank Lines — El grupo de ransomware Storm compromete a la transportista de líquidos Baltimore Tank Lines, exponiendo operaciones de 75 años.
  • [ransomware] Storm reivindica ataque a Merit Financial Group — El grupo de ransomware Storm reivindica el ataque a la gestora de patrimonio Merit Financial Group, exponiendo datos financieros sensibles.
  • [ransomware] Storm reivindica ataque a Patriot Maritime — Patriot Maritime is a leading maritime contractor in the United States, specializing in the management and operation of vessels for both government an
  • [cheatsheet] cheatsheet-de-hydra-y-fuerza-bruta-de-credenciales-sintaxis- — ---
  • [ransomware] Cloak reivindica ataque a dac********er.de — Status: Private | Data size: 2TB | Country: germany
  • [ransomware] Cloak reivindica ataque a ********rta.ch — El grupo Cloak publicó 87 GB de información robada a una entidad suiza, marcando el incidente como privado en su sitio de filtraciones.
  • [CVE] CVE-2026-111866 — A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. This impacts the function cache/del_cache/arr2sql
  • [CVE] CVE-2026-111871 — A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.
  • [CVE] CVE-2026-111872 — A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.
  • [CVE] CVE-2026-111873 — A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.
  • [CVE] CVE-2026-111909 — phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delet
  • [CVE] CVE-2026-111923 — Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers
  • [CVE] CVE-2026-111924 — Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compress
  • [CVE] CVE-2026-111927 — Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorksp
  • [CVE] CVE-2026-111990 — A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1.
  • [CVE] CVE-2026-111998 — Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by us
  • [CVE] CVE-2026-111999 — Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventb
Período2026-10-12 a 2026-10-19
Ítems destacados1402

Grupos de ransomware más activos (histórico)

LockBit (3424)Qilin (2393)Akira (1638)Clop (1368)Play (1331)

Fuente: recentbreaches.com -- ranking acumulado, no víctimas de esta semana.