Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81698] openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's …

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81704] openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus Crypt…

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81692] openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAM…

openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation (np.random.randint(size=(total_samples, channels))). A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81693] openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before material…

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81679] OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the …

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81097] The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylis…

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded m…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-80208] APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in Interna…

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated cli…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-78002] A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow i…

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-5680] A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending speciall…

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30062] An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) v…

An issue in the NGAP handler of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted NAS PDU.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30046] A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to…

A reachable assertion vulnerability in the NUDM-UECM interface of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30047] A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7…

A reachable assertion vulnerability in the /nsmf-pdusession/v1/sm-contexts component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted DELETE request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30050] An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5g…

An issue in the ModifyAMFEventSubscriptionProcedure function (processor/event_exposure.go) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PATCH request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30056] A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers t…

A NULL pointer dereference in the AMF NGAP Dispatcher component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted NGAP messages during the initialization of a new RAN connection.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-30057] An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Deni…

An issue in the CreateUEContext handler component of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad alta en CodeMeter Runtime permite inyección de formato e acceso a memoria

CodeMeter Runtime versiones anteriores a 8.41a y 9.10 contienen una vulnerabilidad de inyección de especificadores de formato printf que permite a atacantes locales y remotos ejecutar denegación de servicio, acceder a memoria del proceso e interceptar canarios de pila. Afecta principalmente a sistemas de licenciamiento y protección de software en empresas de manufatura, energía y servicios financieros de la región.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad de desbordamiento de búfer en CodeMeter Runtime versiones anteriores a 8.41a y 9.10

CodeMeter Runtime, cuando se configura como servidor, es vulnerable a un ataque de lectura fuera de límites (out-of-bounds read) mediante el opcode 0x5e debido a validación insuficiente de longitud de datos. Esta falla causa fallo de segmentación que interrumpe el servicio. Afecta sistemas de licenciamiento de software en empresas manufactureras, de ingeniería y financieras en LATAM que dependen de esta plataforma para protección de activos digitales.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad alta en WibuKey para Windows permite escalada de privilegios local

WibuKey para Windows versiones anteriores a 6.71 contiene una desreferencia de puntero no validado en el controlador kernel WibuKey2_64.sys que permite a un atacante local ejecutar código arbitrario y obtener privilegios de administrador. Esta vulnerabilidad afecta sistemas que utilizan soluciones de licenciamiento y protección de software basadas en WibuKey, comúnmente deployadas en entornos empresariales de México y Latinoamérica.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad alta en WibuKey64.sys permite escalada de privilegios en Windows

Se descubrió una validación deficiente de límites de memoria en WibuKey versión 6.70 y anteriores para Windows, que permite a atacantes manipular punteros y ejecutar código con privilegios de sistema. La vulnerabilidad afecta principalmente a empresas que utilizan soluciones de licenciamiento Wibu-Systems en México y Latinoamérica, exponiendo servidores y estaciones de trabajo a denegación de servicio, escalada de privilegios y potencial ejecución remota de código.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad CSRF sin autenticación en FluentBooking Pro versiones ≤ 2.2.4

FluentBooking Pro versiones 2.2.4 e inferiores presentan una vulnerabilidad de falsificación de solicitud entre sitios (CSRF) sin requerir autenticación previa. Esta falla permite a atacantes ejecutar acciones no autorizadas en plataformas de reserva utilizadas por hoteles, agencias de viajes y servicios de turismo en LATAM. El score CVSS 8.1 indica alto riesgo de compromiso de integridad y disponibilidad de sistemas altas de reservación.

nvdaltovulnerabilidad CVSS 8.1 NVD