Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/08/2026

[CVE-2026-58097] mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buff…

mp_SetEnddisc() copied a user-supplied PSN endpoint value without length validation, allowing a buffer overflow via the ppp(8) command interface. A local user with access to the ppp(8) command interface can crash ppp(8) or potentially execute arbitrary code as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19718] The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin Word…

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing att…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80196] Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remai…

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their pass…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80198] Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and ex…

Kimai versions before 2.56.0 fail to restrict the config() Twig function in sandboxed invoice and export templates, allowing administrators to access arbitrary configuration keys. Attackers with admin privileges can upload malicious templates to exfiltrate server-wide secrets including LDAP bind passwords and SAML private keys into invoice or export documents accessible to lower-privileged users.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80202] Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), wh…

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80191] GROWI applies its page-viewer permission check to attachment requests only when the request carries …

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /atta…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80192] @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 …

@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matchi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80193] Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller…

Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet records for team members by submitting the QuickEntry form, bypassing authorization checks enforced elsewhere.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-76148] CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the…

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-58089] When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach P…

When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly. An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-58090] The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messag…

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-58091] The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If lock…

The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did not handle this possibility. On a system with a multiple audio devices, an unprivileged local user can exploit this use-a…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-54467] On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on …

On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox initialization on PSOC64 and RP2350 accepts a non-secure, unvalidated, supplied pointer.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-57170] Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc…

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-parse the content of an included Markdown file as Jinja2 template code in a non-sandboxed environment, allowing server-side template injection that can lead to arbitr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-57171] Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance doc…

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output path without path-traversal validation, allowing arbitrary file write outside the Trestle workspace. …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-29988] A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Mil…

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC read operation. The exposed keys can be used to decrypt LoRaWAN traffic, forge uplink and downlink frames,…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

25/08/2026

Inyección de comandos alta en TOTOLIK N600R 4.3.0cu.7647_B20210106

Se detectó una vulnerabilidad de inyección de comandos en routers TOTOLINK N600R versión 4.3.0cu.7647_B20210106 a través del parámetro ntp_server en /cgi-bin/cstecgi.cgi. Un atacante remoto puede ejecutar comandos arbitrarios sin autenticación, comprometiendo completamente el dispositivo. Esta vulnerabilidad afecta especialmente a PyMEs y centros de datos en LATAM que usan estos equipos como punto de acceso o pasarela de red.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

Inyección de plantillas en Compliance-trestle permite ejecución remota de código

Compliance-trestle (versiones anteriores a 3.12.4 y 4.0.0-4.0.3) contiene una vulnerabilidad de inyección de plantillas del lado del servidor en las etiquetas Jinja2 MDCleanInclude y MDSectionInclude. Un atacante puede ejecutar código arbitrario reparseando contenido Markdown no confiable como código fuente de plantilla. Afecta a organizaciones que utilizan Trestle para gestionar documentos de cumplimiento OSCAL en México y LATAM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad de replay attack en Spring Security afecta aplicaciones Java

Spring Security contiene una vulnerabilidad de caché que permite ataques de reproducción (replay) contra tokens DPoP (Demonstrating Proof-of-Possession). Un atacante puede desalojar entradas legítimas del caché mediante inundación de solicitudes, para luego reutilizar pruebas DPoP válidas interceptadas. Afecta versiones 6.5.0-6.5.11, 7.0.0-7.0.6 y 7.1.0. El riesgo es alta en sistemas de autenticación OAuth 2.0 y APIs sensibles en instituciones financieras y plataformas de gobierno digital de LATAM.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta de buffer overflow en BlueZ afecta stack Bluetooth de Linux

Una vulnerabilidad de desbordamiento de búfer en la pila Bluetooth de Linux (BlueZ) permite a atacantes remotos dentro del rango de radio enviar paquetes Extended Inquiry Response (EIR) malformados que causan bloqueos del servicio bluetoothd. Afecta servidores Linux, dispositivos IoT y sistemas embebidos comunes en infraestructura LATAM, con potencial de denegación de servicio y ejecución de código remoto.

nvdaltovulnerabilidad CVSS 7.6 NVD