Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81719] openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the …

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81701] openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing …

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic key…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81683] openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client privat…

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps onl…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81335] Baserow dispatches an Application Builder data source without acting on the result of its permission…

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/bui…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81098] The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller cre…

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch f…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81094] The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only whe…

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81096] ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that req…

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup o…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-80208] APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in Interna…

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated cli…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-34674] Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulner…

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-74232] Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1…

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.04…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81036] Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in…

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a regi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81031] IDURAR ERP CRM changes the password of whichever account a request names rather than the account mak…

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and ne…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80427] bestzip builds the argument list for the system zip utility without separating options from operands…

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name t…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80575] In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate…

In the Linux kernel, the following vulnerability has been resolved: Input: cs40l50-vibra - validate custom data from user space cs40l50_add() copies the custom data of an FF_PERIODIC/FF_CUSTOM effect straight from the ff_effect the user passed to EVIOCSFF, without requiring it to hold anything: work_data.custom_data = memdup_array_user(periodic->custom_data, …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80536] In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log it…

In the Linux kernel, the following vulnerability has been resolved: xfs: bounds-check buffer log item's dirty bitmap xlog_recover_do_reg_buffer() replays each dirty region described by a buffer log item's bitmap into the buffer read for that item: memcpy(xfs_buf_offset(bp, (uint)bit ri_buf[i].iov_base, nbits

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74743] In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroo…

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74744] In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom…

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-15990] The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up t…

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Cha…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80203] The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSup…

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super auth…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-18080] The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerabl…

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 1.17.8 via the save_attachments() function. This is due to missing file extension validation and missing path normalization when CRM Email Connect processes inbound IMAP email attachments. This makes it possible for unauthentic…

nvdcriticovulnerabilidad CVSS 9.8 NVD