Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19681] An authenticated command injection vulnerability exists in Security Center related to file upload pr…

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19682] A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker…

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19626] A remote code execution vulnerability exists in Tenable Security Center's report generation function…

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

14/08/2026

Plugin API de Grav vulnerable a bypass de permisos en versiones anteriores a 1.0.13

El plugin API de Grav (getgrav/grav-plugin-api) anterior a la versión 1.0.13 contiene un bypass crítico en los métodos create() y update() del controlador UsersController. Una clave API con permisos limitados (api.users.write) puede escalarse a privilegios de administrador sin que se validen adecuadamente los alcances de seguridad. Esto afecta sistemas de gestión de contenidos en empresas y organizaciones de LATAM que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite ejecución remota de código

El plugin Grav API en versiones anteriores a 1.0.13 no valida correctamente los alcances de claves API en ConfigController, permitiendo a atacantes con permisos limitados inyectar comandos arbitrarios en la configuración del planificador de tareas. Esto resulta en ejecución remota de código a través de Symfony Process, afectando servidores web y sistemas de gestión de contenido en producción.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en getgrav/grav-plugin-api: escalada de privilegios en desactivación de 2FA

El paquete Composer getgrav/grav-plugin-api versiones

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite bypass de permisos de claves API

El plugin Grav API versiones anteriores a 1.0.13 contiene un bypass de alcance de claves API que permite a usuarios con permisos limitados habilitar la ejecución de código Twig en páginas, escalando privilegios sin autorización. Esto afecta plataformas de contenido que utilizan Grav en México y LATAM, exponiendo servidores a inyección de código y ejecución remota.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite escalación de privilegios

El plugin getgrav/grav-plugin-api anterior a la versión 1.0.13 no valida correctamente que los permisos de nuevas claves API sean un subconjunto de los permisos del solicitante. Un atacante con una clave API de bajo privilegio puede crear claves con permisos elevados, comprometiendo aplicaciones Grav alojadas en México y Latinoamérica. Esta vulnerabilidad afecta directamente portales de contenido, sistemas de gestión documental y plataformas educativas que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Inyección SQL crítica en SiYuan v3.7.2 y anteriores permite ejecución de comandos

SiYuan versiones 3.7.2 y anteriores contienen una vulnerabilidad de inyección SQL en la función de búsqueda de referencias inversas y menciones. El fallo radica en la concatenación insegura de metadatos de bloques (título, nombre, alias, texto de anclaje) con palabras clave del cliente en consultas SQL, escapando solo comillas dobles pero no simples. Un atacante puede inyectar comillas simples para ejecutar comandos SQL arbitrarios, comprometiendo la integridad y confidencialidad de bases de datos locales en sistemas Windows, macOS y Linux.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-12949] The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verifica…

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function validating the registration cookie only against the GET reg parameter while accepting the POST mergewith and POST wpm_id parameters without verifying that the mergewith user ID references a t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73842] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73843] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, i…

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods i…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72850] Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to…

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72851] Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered …

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72776] AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that al…

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72839] filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is ena…

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72841] luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowin…

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72842] luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated Lu…

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-8715] Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfi…

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their contents to a tenant-controlled endpoint, potentially leading to privilege escalation within the cluster. Th…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-19297] IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to …

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.

nvdcriticovulnerabilidad CVSS 9.1 NVD