Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16233] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-16234] There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in info…

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution.  Successful exploitation requires an attacker to get a user to open a specially crafted VI.  This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79774] Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability …

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\\Twig\\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models and query builders using methods like saveQuietly(), deleteQuietly(), increment(), decrement(), an…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-69104] An authenticated user may initiate repository migration operations without required repository permi…

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-63075] Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting p…

Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exh…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-54874] Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes Op…

Issue summary: Receiving a DTLS record for a future epoch while a handshake is in progress causes OpenSSL to buffer far more memory than the record itself requires. Impact summary: A peer can use a small amount of network traffic to make an OpenSSL DTLS endpoint retain a disproportionately large amount of memory, which may lead to a Denial of Service. CWE: CWE-405: Asymmetric Resource Consumptio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-18798] Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation f…

Issue summary: QUIC server may double free QRX (QUIC record layer RX) object when channel creation fails for initial packet. Impact summary: Double free leads to heap corruption, which typically results in termination of QUIC server process, leading to Denial of Service. There is so far no evidence that this double free is exploitable for remote code execution, thus it is considered highly impro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad de omisión de autorización en Ech0 anterior a 4.5.1 permite acceso a endpoints administrativos

Ech0 versiones anteriores a 4.5.1 presentan una falla de autorización donde los tokens de sesión no validan permisos en el middleware RequireScopes, permitiendo que usuarios autenticados sin privilegios de administrador accedan a endpoints protegidos. Los atacantes pueden extraer registros del sistema, estadísticas de visitantes, correos de usuarios y suscribirse a logs en vivo mediante WebSocket utilizando tokens de sesión válidos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta de escalada de privilegios en ShopEngine Elementor WooCommerce Builder

El plugin ShopEngine Elementor WooCommerce Builder para WordPress (versiones hasta 4.9.4) contiene una vulnerabilidad de escalada de privilegios (CVSS 7.2) en la función rum_importer() que permite a atacantes ejecutar acciones administrativas sin validación de permisos. Afecta a tiendas en línea en México y LATAM que utilicen este componente para gestionar productos y opciones de WooCommerce. Un atacante puede modificar configuraciones altas, crear cuentas administrativas o inyectar código malicioso en la base de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-63587] The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the …

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliber…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-18323] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute w…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-18328] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will ex…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56709] Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function whe…

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-77567] Filament is a collection of full-stack components for accelerated Laravel development. Prior to vers…

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76073] Label Studio does not scope the annotation detail endpoint to the requesting user's organization. An…

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and lab…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76836] AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not requi…

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPer…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71943] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71938] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp f…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71939] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid admini…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71940] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid admin…

nvdaltovulnerabilidad CVSS 7.2 NVD