Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74879] openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready …

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74880] openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and…

openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74882] openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the enti…

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74883] openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbo…

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74868] SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service…

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74872] openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirl…

openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74874] openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographi…

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74799] SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps w…

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74800] SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when servin…

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74801] SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-lin…

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74802] SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-onl…

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attac…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19982] A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability af…

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explain…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19983] A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE…

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgra…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19980] A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE930…

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated re…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19981] A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launc…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19979] A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-19977] A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function http…

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19963] A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function sta…

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19962] A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setW…

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respo…

nvdaltovulnerabilidad CVSS 7.4 NVD