Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54366] CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows un…

CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated StorageConfig endpoint causing the server to fetch and parse attacker-controlled XML containing external DTD…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54367] CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated …

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54368] CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchE…

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized interpolation of the Field parameter directly into SQL query strings to write arbitrary files to th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-41703] VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor w…

VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out-of-bounds read, potentially leading to information disclosure or more likely a Denial-of-Service (DoS) condition of the host process. On Workstation and Fusion, the impact of this vulnerability is restricted to information disclosure.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-18378] A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resourc…

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-18381] A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMe…

A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15397] The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all…

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps_sfw_install_plugin_configuration AJAX handler. This makes it possible for authenticated attackers, with shop manager-level access and above, to install a…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-22620] Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware…

Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-22621] Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PA…

Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-22622] Improper input validation in one of the session management interface of Eaton's Tripp Lite series PA…

Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-18360] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-18361] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16969] The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site sc…

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

CVE-2026-24304 Azure Resource Manager Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-24304 Azure Resource Manager Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

azureeop Microsoft MSRC

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44106] A privilege escalation vulnerability in the init-script for user-applications allows a low-privilege…

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44107] A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefor…

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-44108] Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematur…

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-7849] Due to improper neutralization of special elements, an unauthenticated remote attacker is able to in…

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-44099] A privilege escalation vulnerability in the system configuration allows a low-privileged local user …

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-44100] The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points.…

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

nvdcriticovulnerabilidad CVSS 9.4 NVD