Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/08/2026

[CVE-2026-61372] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-41453] Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allo…

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenated without parameterized binding directly into a havingRaw() call in LeadDataGrid.php. Attackers can exploit this flaw using time-based and bo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18718] Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allow…

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes t…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-39931] OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configurat…

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the form_step=202 parameter in backup.php. Attackers can exploit the unfiltered shell_exec invocation of th…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18605] A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown funct…

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to t…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18606] A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is…

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files (x86)\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument lpThreadParameter can lead to improper privilege management. The attack requires local access. The exploit has be…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18568] XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify …

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no ele…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-67609] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leverage…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69095] OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path travers…

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69096] OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.…

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler build…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69097] GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attacke…

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69089] Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it…

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically collapses '..' segments without a realpath/containment check, an editor authoring Markdown image syntax with traversal sequences can cause arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-67608] Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a…

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18600] A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.s…

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18092] Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping…

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //sa…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18089] Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses aga…

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured. verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig check succeeds, and that check uses the X.509 certificate taken from the response's own dsig:KeyInfo/dsi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18598] A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function …

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-18599] A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread…

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command injection. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/08/2026

Vulnerabilidad alta de validación de entrada en módems permite denegación de servicio remota

Se ha identificado una falla de validación de entrada impropia en módems que permite a atacantes remotos provocar denegación de servicio sin necesidad de privilegios adicionales. Esta vulnerabilidad (CVSS 7.5) afecta directamente la disponibilidad de conectividad en infraestructuras altas, centros de datos y redes corporativas en México y Latinoamérica que dependen de estos dispositivos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/08/2026

Vulnerabilidad de validación de entrada en módems permite denegación de servicio remota (CVE-2026-21554)

Se ha identificado una falla de validación de entrada en módems de múltiples fabricantes que permite ataques de denegación de servicio remota sin requieren privilegios adicionales. Esta vulnerabilidad afecta infraestructura alta de conectividad en empresas y proveedores de servicios en LATAM. Con puntuación CVSS 7.5, representa un riesgo elevado para la continuidad operativa de sistemas que dependen de estos dispositivos.

nvdaltovulnerabilidad CVSS 7.5 NVD