Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/08/2026

[CVE-2026-47615] NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request for…

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2025-29296] H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R0…

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (de…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24083] Memory Corruption while processing IOCTL device driver requests with invalid arguments.

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24079] Cryptographic Issue while processing registration requests with malformed or missing authentication …

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24080] Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory Corruption when handling malformed request parameters in the fingerprint TA.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67198] Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatche…

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine dis…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67200] Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attacke…

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad de session hijacking en HUMANIST Digital Human Resources por uso de GET con parámetros sensibles

HUMANIST Digital Human Resources (versiones 26.0 a 26.1) expone credenciales y tokens de sesión en strings de consulta GET, permitiendo secuestro de sesiones. Afecta a departamentos de Recursos Humanos en empresas de México y LATAM que utilizan este sistema para gestión de nómina y personal. El riesgo alta radica en la facilidad de captura de información sensible en logs de servidor, proxies corporativos e historiales del navegador.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad de path traversal no autenticado en CustomSounds (CVE-2026-56845)

Existe una vulnerabilidad de lectura local de archivos (LFI) no autenticada en módulos CustomSounds configurados con almacenamiento FileSystem. Un atacante puede leer archivos arbitrarios del servidor utilizando secuencias ../ en la ruta de solicitud, comprometiendo datos sensibles como credenciales, configuraciones y archivos de aplicación. Esta vulnerabilidad afecta directamente a plataformas de comunicaciones unificadas y sistemas PBX en empresas mexicanas y latinoamericanas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48331] Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that …

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69246] Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the req…

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPT_URL to the URI exactly as written and push that Host into CURLOPT_HTTPHEADER; StreamHandler does the same through fopen(). libcurl then parses the authority itself, percent-decoding it and, on an IDN-capable buil…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18647] A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8f…

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-67598] Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/ser…

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST are unconditionally disabled across sendStream(), sendImageRequest(), send(), and fetchSe…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-41452] Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that al…

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-18248] @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and re…

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP head…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-64827] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16300] The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, all…

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/08/2026

[CVE-2026-68579] FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard cli…

FreeRDP before 3.30.0 (

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

02/08/2026

[CVE-2025-71399] Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3,…

Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extr…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

02/08/2026

[CVE-2025-71400] better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability …

better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated users to delete arbitrary passkeys by ID. Attackers with valid sessions can submit crafted requests to the delete-passkey endpoint with enumerated passkey IDs to remove other users' passkeys.

nvdaltovulnerabilidad CVSS 7.1 NVD