Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad SSRF alta en Koito v0.3.2 permite ejecución de requests arbitrarios

Se ha identificado una vulnerabilidad de falsificación de solicitud del lado del servidor (SSRF) en Koito versiones hasta v0.3.2 que permite a usuarios autenticados forzar al servidor a realizar peticiones HTTP hacia hosts internos o externos mediante parámetros malformados en el endpoint PATCH /apis/web/v1/album/{id}/image. Esta vulnerabilidad (CVSS 7.7) compromete la integridad de la red interna y puede facilitar acceso no autorizado a servicios internos, representando un riesgo significativo para infraestructuras en LATAM que utilicen este software.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad XSS almacenado en lobe-chat v2.2.13 permite inyección de código arbitrario

Una vulnerabilidad de cross-site scripting (XSS) almacenado en lobe-chat hasta la versión 2.2.13 permite a usuarios autenticados con privilegios bajos inyectar código JavaScript malicioso al cargar un archivo SVG manipulado como avatar. El impacto afecta a empresas que utilizan esta plataforma de chat en entornos internos o en la nube, comprometiendo la sesión de otros usuarios que visualicen el perfil afectado. Con CVSS 7.6, representa un riesgo considerable en infraestructuras compartidas de LATAM.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad SSRF alta en xiaoai-patch permite solicitudes HTTP no autorizadas

Una vulnerabilidad de falsificación de solicitudes del lado del servidor (SSRF) en xiaoai-patch (commit fb07049) permite a atacantes remotos forzar altavoces inteligentes Xiaomi a realizar peticiones HTTP hacia URLs internas o externas arbitrarias. El endpoint /auth en api/main.py no valida el parámetro url en solicitudes POST, exponiendo redes internas y servicios Home Assistant en organizaciones de México y Latinoamérica que utilicen este parche.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad de race condition en FastSchema permite bypass de límite de intentos OTP

FastSchema versiones anteriores a v0.15.2 contiene una vulnerabilidad de time-of-check/time-of-use (TOCTOU) que permite a atacantes no autenticados eludir el límite de intentos en la recuperación de cuenta, exponiendo códigos OTP de 6 dígitos a ataques de fuerza bruta. Empresas que usan FastSchema en plataformas de gestión de contenido o autenticación enfrentan riesgo de compromiso de cuentas de usuario.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad de autenticación faltante en FUXA 1.3.3 expone datos históricos de sensores

FUXA, plataforma de supervisión industrial de código abierto, contiene una vulnerabilidad que permite a atacantes no autenticados acceder a datos históricos completos de sensores mediante el evento Socket.IO DAQ_QUERY. Aunque otros eventos requieren validación de token cuando secureEnabled=true, DAQ_QUERY carece de verificación de autenticación. Esta exposición afecta especialmente a plantas de manufactura, utilities y sistemas SCADA en México y Latinoamérica que utilizan FUXA para monitoreo de dispositivos altas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

Inyección de comandos OS en pm2panel (todas las versiones) permite ejecución remota de código

Una vulnerabilidad alta en pm2panel permite a atacantes autenticados ejecutar comandos arbitrarios en el sistema operativo del servidor sin validación de entrada. El parámetro req.query.id se pasa directamente a funciones exec() sin sanitización, permitiendo encadenamiento de comandos mediante caracteres especiales de shell. Afecta a sistemas de gestión de procesos en infraestructuras DevOps y hosting en la región.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad CSRF alta en FreePBX Framework 17.0 permite acciones administrativas no autorizadas

Una vulnerabilidad de falsificación de solicitud entre sitios (CSRF) en FreePBX Framework 17.0 permite a atacantes remotos no autenticados realizar acciones administrativas suplantando a administradores legítimos. Esta falla afecta directamente a sistemas PBX en empresas, centros de contacto y proveedores de telecomunicaciones en LATAM que dependen de esta plataforma para gestionar comunicaciones altas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72579] An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attack…

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72572] A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attac…

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive sys…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-61899] Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to downlo…

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-65942] TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recomme…

TLS hostname verification issue in Apache Ranger Client Code in versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-65948] UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a …

UnixAuth lacks brute-force protection in Apache Ranger versions

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-59087] A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks f…

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-55814] Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to…

Missing Authentication in Apache Ranger Download APIs on versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-64940] Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a pe…

Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected product to log in to the management console. As a result, the attacker may perform any operations available from the management console.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19384] A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected…

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=set_appointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19387] A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element…

A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insufficient validation of the per-block sample count for multi-channel streams allows a crafted WAV file to cause writes beyond the allocated output buffer. This can lead to application crash, denial of service, memory corruption, or potentially arbitrary code ex…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19389] Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly…

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause out-of-bounds heap reads. This can result in application crash, denial of service, or limited information …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19381] A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacte…

A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted e…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-19379] A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the …

A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD