Vulnerabilidades · "X" — Alertas SI

M Alto vulnerabilidad

18/08/2026

[CVE-2026-60393] Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component…

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthor…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-60412] Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou…

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction f…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-60413] Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Ou…

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction f…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-54347] Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accept…

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and templates/Froxlor/table/table.html.twig renders the callback result with the raw filter. An authenticated customer …

M Alto vulnerabilidad

18/08/2026

[CVE-2026-54348] Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.upd…

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel_admins.ip without enforcing numeric element types. When the poisoned account later calls IpsAndPorts.listing, lib/Froxlor/Api/Commands/IpsAndPorts.php decodes the array an…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-55426] linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integ…

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugins 6.0.0, check plugins embedded user-controlled values in command strings passed to lib.shell.shell_exe…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-52793] Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path i…

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentica…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75935] Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 migh…

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation. To remediate this issue, users should upgrade to version 1.12.0.

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75936] Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-jav…

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression. To remediate this issue, users should upgrade to version 1.12.0 and configure withGzipDecompressionEnabled(false) and/or set a…

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75877] A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function Syst…

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71417] Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a no…

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permission on the underlying authority. PUT /api/1/certificates//revoke authorized the caller against only the selected Lemur row, so the creator of the duplicate bypasse…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71307] Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/desti…

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allow…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-59915] Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violati…

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

M Alto vulnerabilidad

18/08/2026

[CVE-2026-52829] ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can det…

ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration. The handshake path canonicalized an IPv4-mapped IPv6 PeerSocketAddr such as ::ffff:127.0.0.1 to plain IPv4 before storing it through MetaAddr::new_connected, but the mempool misbehavior path forwa…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-47719] FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE…

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against ar…

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-55166] Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME …

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. T…

M Alto vulnerabilidad

18/08/2026

[CVE-2026-47629] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause impr…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service.

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-47627] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.

M Alto vulnerabilidad

18/08/2026

[CVE-2026-47628] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an a…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service.

M Alto vulnerabilidad

18/08/2026

[CVE-2026-24183] NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivilege…

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system. A successful exploit of this vulnerability might lead to escalation of privileges.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?