Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76795] A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of th…

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch i…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76783] A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown …

A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76762] A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an …

A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of the file /welcome.php. The manipulation of the argument userid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76764] A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an un…

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76928] X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76761] A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExe…

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically due to inac…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76760] A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the f…

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76403] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network …

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with Hypertext Transfer Protocol (HTTP) Event Collector in Splunk Enterprise. The vulnerability is possible because the Kerberos authentication path does not apply the configured certificate valid…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76591] A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function …

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log_email_server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76832] Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that al…

Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool actions. Attackers can inject traversal sequences such as '../../../../../../etc/passwd' through direct too…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76395] In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute ar…

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Tro…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76397] In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and…

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more info…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76402] In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Co…

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure a non-secure Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise that causes the connector to send authentication credentials to an attacker-controlled server, allowing for exposure of credentials that comp…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76389] In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a …

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76362] In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffi…

In Splunk SOAR versions below 8.6.0, an unauthenticated user who can observe or alter network traffic between Splunk SOAR and a configured CyberArk Representational State Transfer (REST) server could access or modify all relevant data exchanged through that credential manager. The vulnerability is possible because the CyberArk REST client does not verify server certificates by default. The attack …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76355] In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the informat…

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76356] In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a …

In Splunk SOAR versions below 8.6.0, an unauthenticated user could spoof the source IP address in a crafted request to an Automation Broker notification endpoint and execute arbitrary code on the Splunk SOAR host. The vulnerability is possible because the Splunk SOAR Automation Broker trusts a client-supplied source IP address header as proof that the request originates from the local system. Succ…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76357] In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a craf…

In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could submit a crafted file path to the Representational State Transfer (REST) API and execute arbitrary code. The vulnerability is possible because the REST API does not require an assigned role for the request and does not restrict the user-supplied file path to the intended temporary directory. For more information…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76350] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role wit…

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could configure Portable Document Format (PDF) attachments in the email alert action workflow. When the email alert action runs, it could execute arbitrary Search Processing Language (SPL) commands with system-level privileges, expose all relevant data, and affect sy…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76336] In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "powe…

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Representational State Transfer (REST) API. This could delete exported datasets and functions, affect system integrity, and cause partial service …

nvdaltovulnerabilidad CVSS 7.1 NVD