Alertas de Seguridad de la Información

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73644] OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identi…

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an au…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73533] Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered …

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-53791] rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated …

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-61967] Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.

Unauthenticated Privilege Escalation in miniorange otp verification

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

Vulnerabilidad crítica de autenticación impropia (CVE-2026-59500) afecta múltiples productos

Se ha identificado una vulnerabilidad de severidad crítica (CVSS 10.0) en mecanismos de autenticación de múltiples fabricantes, permitiendo a atacantes eludir controles de acceso sin credenciales válidas. Esta falla afecta directamente infraestructuras críticas en México y Latinoamérica que dependen de sistemas de identificación y acceso. El impacto abarca compromisos totales de confidencialidad, integridad y disponibilidad en sistemas afectados.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49819] UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentica…

UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a conditio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-49481] UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability …

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sani…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73501] kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() i…

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on Valida…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-71471] A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub clust…

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the attacker to deploy an arbitrary container image across all managed clusters. The consequence is remote code execution (RCE), enabling the attac…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-66898] A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during back…

A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When importing or restoring a backup archive, LXD fails to validate instance and storage volume names contained within the archive metadata. An attacker can exploit this flaw by supplying a crafted backup archive with malicious instance or volume names containing pa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-63298] An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration …

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execut…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73263] Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep…

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dic…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-50561] Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor…

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment ins…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica de buffer overflow en servicios PROFINET (CVE-2025-41769)

Los dispositivos con servicio PROFINET están expuestos a un buffer overflow en configuración por defecto que permite a atacantes remotos no autenticados ejecutar código arbitrario o reiniciar los equipos. Esta vulnerabilidad afecta principalmente infraestructura industrial, sistemas de automatización y dispositivos IoT en plantas manufactureras, utilities y sectores críticos en LATAM. La ausencia de autenticación requerida amplifica significativamente el riesgo de explotación.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

Inyección SQL ciega crítica en Essekia Tablesome Table versiones hasta 1.2.9

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-66659) en Essekia Tablesome Table que permite a atacantes ejecutar consultas SQL no autorizadas sin necesidad de ver respuestas directas (SQL Injection Ciega). Esta falla afecta a organizaciones en México y Latinoamérica que utilizan este componente para gestión de tablas en aplicaciones web, exponiendo bases de datos críticas a acceso no autorizado, robo de datos sensibles y manipulación de registros.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18366] The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, di…

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en Red Hat Advanced Cluster Management permite robo de tokens de clusters

Se identificó una falla en el componente multicloud-integrations de Red Hat Advanced Cluster Management (RHACM) que permite a usuarios autenticados manipular el controlador GitOpsCluster y redirigir tokens de bearer de clusters spoke hacia namespaces bajo su control. Esta vulnerabilidad (CVSS 9.6) afecta principalmente a empresas en LATAM con infraestructuras multicloud híbridas en Kubernetes, exponiendo credenciales críticas de acceso a recursos en la nube pública y privada.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en multicloud-integrations permite ejecución de comandos en clusters Kubernetes

Se descubrió una falla en el componente multicloud-integrations que permite a un usuario con permisos de creación de Applications en el cluster hub explotar la validación deficiente de anotaciones para dirigirse a clusters Kubernetes arbitrarios. Un atacante podría forzar la sincronización maliciosa de ArgoCD en clusters spoke, comprometiendo la integridad de aplicaciones críticas en infraestructuras multi-nube. Este riesgo es crítico (CVSS 9.9) para empresas en LATAM que gestionan plataformas DevOps centralizadas.

nvdcriticovulnerabilidad CVSS 9.9 NVD

F Crítico vulnerabilidad

12/08/2026

FGFM Authentication Weakening via CLI Configuration

Fortinet PSIRT publica advisory de seguridad: FGFM Authentication Weakening via CLI Configuration. Tipo: Bypass de Autenticación. Producto afectado: Fortigate.

firewallfortigateauth-bypass PAN PSIRT

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-5917] libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain…

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository …

nvdcriticovulnerabilidad CVSS 9.6 NVD