Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10870] A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file …

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

04/06/2026

[CVE-2026-10796] nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied …

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-59874] HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is det…

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Crítico vulnerabilidad

04/06/2026

[CVE-2026-50211] Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail buil…

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Medio vulnerabilidad

04/06/2026

Vulnerabilidad de divulgación de información en Microsoft 365 Copilot (CVE-2026-42824)

Microsoft 365 Copilot presenta una vulnerabilidad de divulgación de información que podría exponer datos sensibles a usuarios no autorizados. Esta vulnerabilidad afecta directamente a organizaciones en México y Latinoamérica que utilizan Copilot en entornos corporativos, especialmente en sectores regulados como finanzas y salud. El impacto es moderado pero requiere atención inmediata para evitar exposición de información confidencial en chats y documentos corporativos.

info-disclosure Microsoft MSRC

A Crítico vulnerabilidad

04/06/2026

[CVE-2026-49191] The production build of the M3WebServer hard-codes its backend API keys, which can be easily interce…

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41010] ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@re…

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41011] PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packa…

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41859] A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentia…

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every dir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44609] Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: …

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44682] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50033] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-42061] Local privilege escalation due to excessive permissions assigned to child processes. The following p…

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

02/06/2026

[CVE-2026-42211] React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a c…

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-1829] The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution …

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10617] A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the…

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-45553] NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reSt…

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40619] A high security vulnerability affecting Security Center main server installations has been identifie…

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40780] Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP Boo…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7195] CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4…

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user intera…

nvdaltovulnerabilidad CVSS 8.8 NVD