Alertas de Seguridad de la Información

F Crítico vulnerabilidad

09/06/2026

[CVE-2026-49840] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

09/06/2026

[CVE-2026-10523] An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R1…

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2017-20251] WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that al…

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the ser…

nvdcriticovulnerabilidad CVSS 9.8 NVD

Q Crítico vulnerabilidad

09/06/2026

[CVE-2026-44083] An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagi…

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-40128] SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a …

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-52778] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability e…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11393] Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI be…

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collab…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-39910] STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low…

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-41448] AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability t…

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in…

nvdcriticovulnerabilidad CVSS 9.4 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-42535] A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to d…

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11499] A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function…

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico amenaza

07/06/2026

Alerta ThreatFox: Agentemis,BEACON,CobaltStrike,cobeacon activo — 958 IOCs (07 de June de 2026)

ThreatFox (abuse.ch) detectó 958 IOCs de Agentemis,BEACON,CobaltStrike,cobeacon (Post-Exploitation Framework) en las últimas 24h. Tipos: 451 IP de Comando y Control (C2), 507 Dominio malicioso. Nivel: CRITICO.

threat-intelthreatfoxioc Editorial

A Crítico amenaza

07/06/2026

Alerta ThreatFox: RemcosRAT,Remvio,Socmer activo — 187 IOCs (07 de June de 2026)

ThreatFox (abuse.ch) detectó 187 IOCs de RemcosRAT,Remvio,Socmer (RAT (Troyano de Acceso Remoto)) en las últimas 24h. Tipos: 180 IP de Comando y Control (C2), 7 Dominio malicioso. Nivel: CRITICO.

threat-intelthreatfoxioc Editorial

A Crítico vulnerabilidad

05/06/2026

[CVE-2026-11420] Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Se…

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session, or credentials are required. Because content-controlled files can be written to web-accessible …

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Crítico vulnerabilidad

05/06/2026

[CVE-2026-46389] UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs…

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernete…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-10580] The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass le…

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_acce…

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Crítico vulnerabilidad

05/06/2026

[CVE-2026-45746] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. Thi…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71317] NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants…

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71318] NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remo…

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — includin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

B Crítico vulnerabilidad

05/06/2026

[CVE-2026-11362] DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog:…

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metr…

nvdcriticovulnerabilidad CVSS 9.8 NVD