Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41011] PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packa…

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41858] Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem…

Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a network attacker to estimate VM boot time and reconstruct a small candidate list to recover the Administrator password. The randomize_password job exists solely to lock the local Administrator account behind an unguessable password as a hardening control. Becaus…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41859] A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentia…

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every dir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10737] The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a…

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive informatio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10777] A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8…

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10771] A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntit…

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The proj…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44609] Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: …

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44682] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50033] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-42061] Local privilege escalation due to excessive permissions assigned to child processes. The following p…

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36609] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce t…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined with the predictable XOR-based password encoding (securityEncode function), this allows an attacker to reverse captured authentication tokens to recover the plaintext password.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36611] Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w…

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36603] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions wi…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP is enabled by default through the admin interface, allowing any unauthenticated LAN device to create arbitrary port forwarding rules and access WAN traffic statistics.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36606] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with …

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36607] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force a…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied to the login endpoint (code=7). An attacker on the adjacent network can attempt unlimited passwords without triggering account lockout.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36608] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forwar…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37462] An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows …

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36574] A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escal…

A DLL hijacking vulnerability in Wassimulator (GitHub) CactusViewer v2.3.0 allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37460] Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.…

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15655] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.

nvdaltovulnerabilidad CVSS 7.6 NVD