Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51924] An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the…

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51925] A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a rem…

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51926] An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive informati…

An issue in docuForm GmbH FSM Client v.11.11c allows a remote attacker to obtain sensitive information via the login.php component. A vulnerability was identified in the authentication mechanism that allows user enumeration through the login interface. An attacker can differentiate between valid and invalid usernames based on variations in server responses. This information can be leveraged to ide…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55207] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the vic…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2025-45422] Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal …

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-15270] A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability …

A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has bee…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0276] A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally a…

A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0278] Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) compone…

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59148] Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-ser…

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-54695] Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa…

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSeria…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13492] The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and inc…

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.65. This is due to insufficient validation of file-field values in the UsersWP_Validation::validate_fields() function (which falls through to sanitize_text_field() for fields of type 'file', leaving directory-traversal sequences intact) combined with the UsersWP_Forms::upload_file_remove…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0286] A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software ena…

A command injection vulnerability in the management plane of Palo Alto Networks PAN-OS® software enables an authenticated administrator to execute arbitrary OS commands as root. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls an…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0287] Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthent…

Multiple denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a dataplane interface. Repeated attempts to trigger this condition result in the firewall entering maintenance mode. Panorama is not impacted by these vulnerab…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Crítico vulnerabilidad

09/07/2026

[CVE-2026-0284] An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PA…

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or corruption of internal LSVPN satellite data. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

nvdcriticovulnerabilidad CVSS 9.9 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0283] An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networ…

An authentication bypass vulnerability in Large Scale VPN ( LSVPN) functionality of Palo Alto Networks PAN-OS software allows an attacker with network access to bypass security restrictions and establish an unauthorized site-to-site VPN connection. Panorama, Cloud NGFW, and Prisma® Access are not impacted by this vulnerability.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0280] An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enab…

An IPv6 packet processing vulnerability in the dataplane of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker to bypass firewall security policy enforcement, allowing network traffic that should be blocked to reach protected services. Cloud NGFW and Panorama are not impacted by this vulnerability.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0281] An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenti…

An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker. The security risk posed by this issue is minimized by restricting access to the management web interface to o…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2025-63579] Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to b…

Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming data ian be bypassed with this vulnerability, allowing encrypted data to be decrypted. Passwords and other sensitive information can be obtained. This affects Kyocera Command Center RX TASKalfa 2552ci, TASKalfa 3252ci, TASKalfa 2553ci, TASKalfa…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-61343] LibreBooking's email template editor save action passes the submitted template name directly into th…

LibreBooking's email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write an arbitrary file outside the template directory and execute code. Fixed in 5.1.0.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-59720] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in m…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field while schema.prisma defaults isPublic to true, causing mock servers linked to private collections to be publicly accessible without authentication and potentially expose sensitive API data. This issue is fixed in version 2026.6.0.

nvdaltovulnerabilidad CVSS 7.5 NVD