Alertas de Seguridad de la Información

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51725] Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows…

Incorrect access control in the NTPSyncWithHost function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the device clock via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51730] Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows…

Incorrect access control in the delWiFiAclRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi ACL rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51720] Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 a…

Incorrect access control in the delIpPortFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove firewall filter rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51679] Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows …

Incorrect access control in the setPasswordCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to change the administrator account via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51680] Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unaut…

Incorrect access control in the setLedCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify LED behavior via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-51681] Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows un…

Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

31/08/2026

Vulnerabilidad crítica en hulumi v1.3.2 permite eludir restricciones IAM en despliegues

Versiones de hulumi anteriores a v1.3.2 contienen una plantilla SCP deficiente que permite a atacantes eludir las protecciones de límites IAM mediante bypass de etiquetas en la creación de recursos. Esta vulnerabilidad afecta directamente a organizaciones que implementan hulumi:iac-role para segregación de accesos en AWS, comprometiendo la integridad de los controles de identidad y acceso en infraestructura como código.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82856] @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition ope…

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-54745] Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. …

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the Kubeflow Pipelines frontend exposes an unauthenticated server-side request forgery vulnerability through the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its o…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77551] A malicious actor with access to the network and under certain conditions could exploit an Improper …

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77553] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77557] A malicious actor with access to the network could exploit an Improper Access Control vulnerability …

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77541] A malicious actor with access to the network and high privileges could exploit an Improper Access Co…

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77534] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77536] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-65182] Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security co…

Improper Access Control, Incorrect Authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.0.M1 through 9.0.120, from 8.5.0 through 8.5.100, from 7.0.0 throu…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-55536] PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connectio…

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server _handle_connection() checks Chrome extension origins with re.match() and the unanchored expression chrome-extension://[a-z0-9]{32}. Extra trailing characters pass before websocket.accept(), allowing start_session commands and unauthorized browser automation. This issue is fixed in version 4.6.58.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66309] Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov…

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66788] A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vu…

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76310] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk r…

nvdcriticovulnerabilidad CVSS 9.4 NVD