Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59909] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privil…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-59910] Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elemen…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19693] extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and nev…

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-15218] A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. Th…

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these exces…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-16137] In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential…

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-16138] In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of…

In Progress ShareFile Storage Zones Controller v5.12.5 and below versions, unsafe deserialization of untrusted file metadata can allow a user with write access to a Network share to execute arbitrary code on the Storage Zones Controller host.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-16139] In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zon…

In Progress ShareFile Storage Zones Controller versions

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74997] In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk pl…

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74998] In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style S…

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75002] In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desyn…

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta de path traversal en openssl_encrypt anteriores a v1.4.0

openssl_encrypt versiones anteriores a 1.4.0 contienen una vulnerabilidad de path traversal (CVE-2026-74884, CVSS 7.5) en el método _is_safe_path que no sanitiza el parámetro plugin_id, permitiendo a atacantes acceder a directorios arbitrarios fuera del directorio de plugins mediante secuencias como '../'. Empresas en México y LATAM que usen este componente en aplicaciones web o sistemas de gestión de contenido enfrentan riesgo de exposición de información sensible y potencial ejecución de código.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta en openssl_encrypt: derivación de claves débil permite cracking de contraseñas (CVE-2026-74888)

openssl_encrypt versiones anteriores a 1.4.0 implementan una construcción PBKDF2 no estándar con iteraciones=1 por llamada, debilitando significativamente la derivación de claves. Atacantes pueden comprometer archivos cifrados legacy con esfuerzo computacional reducido. Afecta sistemas que protegen datos financieros, médicos y personales en empresas mexicanas y latinoamericanas que usan esta librería para cifrado de datos en reposo.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74879] openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready …

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74882] openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the enti…

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74883] openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbo…

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74868] SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service…

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74874] openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographi…

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74801] SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-lin…

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74802] SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-onl…

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attac…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD