Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84696] Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique comm…

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-84423] A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file …

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanat…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

01/09/2026

[CVE-2026-79687] Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unau…

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-18771] Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co…

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Authentication Bypass. This issue affects Talassoft Industrial Management Software: from V4 before V.16.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82919] A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the func…

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-54598] Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo…

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-75133] Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulner…

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-66047] ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code…

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a caller-controlled URL through the file request parameter to trigger silent plugin …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82693] A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function …

A vulnerability was determined in Tenda AC1206 15.03.06.23. This vulnerability affects the function TendaTelnet of the file /goform/telnet of the component Web UI. Executing a manipulation can lead to missing authentication. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82694] A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSe…

A vulnerability was identified in Tenda AC1206 15.03.06.23. This issue affects the function R7WebsSecurityHandler of the file /goform/ate of the component Web UI. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82695] A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of th…

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-58574] Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenti…

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full adminis…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/08/2026

[CVE-2026-82641] keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces with…

keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/08/2026

Vulnerabilidad alta en Documenso: carga de PDF sin autenticación en endpoint /api/files/upload-pdf

Documenso versiones anteriores a 2.13.0 permite la carga de archivos PDF sin requerir autenticación en el endpoint /api/files/upload-pdf. Atacantes no autenticados pueden subir PDFs arbitrarios indefinidamente, agotando recursos de almacenamiento y saturando bases de datos con registros huérfanos. Esta vulnerabilidad afecta principalmente a empresas mexicanas y latinoamericanas que utilizan Documenso para gestión de documentos digitales y flujos de firma electrónica.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/08/2026

Vulnerabilidad alta en KubeEdge CloudCore 1.23.1 permite falsificación de estado de actualización de nodos

KubeEdge CloudCore versiones hasta 1.23.1 acepta reportes de estado de tareas sin autenticación en puerto 10002, permitiendo a atacantes modificar el estado de trabajos de upgrade. Esto compromete la integridad del plano de control en infraestructuras edge/IoT, siendo alta para organizaciones en LATAM con despliegues en manufactura, utilities y telecomunicaciones que dependen de orquestación automática de actualizaciones.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

29/08/2026

[CVE-2026-82452] rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most…

rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-82282] Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticat…

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-82277] Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operatio…

Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-82266] Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting t…

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-78239] Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, …

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD