Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73264] Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provide…

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73284] RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/…

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73285] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, R…

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypas…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73263] Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep…

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dic…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-68757] A user with access to a valid SAML response may impersonate another user under specific conditions.

A user with access to a valid SAML response may impersonate another user under specific conditions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-68752] A Project Resource Manager may gain broader administrative privileges under specific conditions.

A Project Resource Manager may gain broader administrative privileges under specific conditions.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-66375] A low-privilege authenticated user may permanently remove protected internal metadata across reposit…

A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-50561] Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor…

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment ins…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-14478] A maliciously created executable, when executed on the victim's machine, may allow a local low-privi…

A maliciously created executable, when executed on the victim's machine, may allow a local low-privileged attacker to inject unauthenticated IPC messages into named pipes, modify pipe permissions or ownership, and potentially impact confidentiality, integrity, and availability.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2025-59319] CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intende…

CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to certify the integrity of the intended boot partition and selects the first partition index matching a hardcoded type value. A crafted Linux partition could be inserted ahead of this intended target, allowing for code execution in the context of high privilege.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-47231] Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-file…

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the actor has `hasUploadRight()` on the URL parameter `folder_uuid`. The `move_save` handler then operates on a *separate* URL parameter `file_uuid` and calls `File::moveToFolder($destFolderUUID)`. `File::moveToFolder()` checks the upload right on t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-70468] A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.…

A authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, FortiManager 7.4.3 through 7.4.5, FortiManager 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, FortiManager Cloud 7.4.3 through 7.4.5, FortiManager Cloud 7.2.5 through 7.2.9 may allow attacker to improper access control via

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-26035] An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through …

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-53996] NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerabil…

NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-57858] Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in …

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to …

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

12/08/2026

Desbordamiento de búfer alta en Fortinet FortiClient Windows permite ejecución remota de código

Una vulnerabilidad de desbordamiento de búfer en Fortinet FortiClient Windows (versiones 7.2.0-7.2.11 y 7.4.0-7.4.3) permite a atacantes no autenticados ejecutar código arbitrario manipulando respuestas DNS. El ataque requiere posición en la red para alterar tráfico DNS, afectando principalmente a empresas en LATAM con VPN corporativos que confían en FortiClient para acceso remoto seguro.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta de ejecución remota de código en repositorio archivado de Cloudflare

Se ha identificado una vulnerabilidad de ejecución remota de código (RCE) en un repositorio archivado de Cloudflare, explotable a través de configuraciones específicas de GitHub Actions. La vulnerabilidad permite comprometer secretos de flujo de trabajo altas como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN, exponiendo credenciales de acceso a infraestructura en la nube. Empresas en LATAM que utilicen este repositorio o mantengan integraciones con GitHub Actions deben verificar inmediatamente su exposición.

nvdaltovulnerabilidad CVSS 8.8 NVD

P Medio vulnerabilidad

12/08/2026

CVE-2026-0293 Prisma Access Agent: Anti-Tamper Protection Bypass on Windows

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0293 Prisma Access Agent: Anti-Tamper Protection Bypass on Windows (Severity: MEDIUM). Tipo: Vulnerabilidad de seguridad. Producto afectado: Prisma Access.

firewallngfwprisma-access PAN PSIRT

P Alto vulnerabilidad

12/08/2026

PAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026)

Palo Alto Networks PSIRT publica advisory de seguridad: PAN-SA-2026-0011 Chromium: Monthly Vulnerability Update (August 2026) (Severity: HIGH). Tipo: Vulnerabilidad de seguridad. Producto afectado: Palo Alto Networks.

firewallngfw PAN PSIRT

P Alto vulnerabilidad

12/08/2026

CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0295 GlobalProtect App: Local Privilege Escalation via Race Condition on macOS (Severity: MEDIUM). Tipo: Escalación de Privilegios. Producto afectado: GlobalProtect.

firewallngfwglobalprotect PAN PSIRT