Alertas de Seguridad de la Información

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85031] A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of th…

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-80726] In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear ro…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_m…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en autenticación FIDO2 permite suplantación de identidad en despliegues locales

Una vulnerabilidad de puntuación CVSS 9.8 en sistemas FIDO2 permite a atacantes registrar credenciales maliciosas contra cuentas objetivo y autenticarse como el usuario legítimo. El riesgo afecta únicamente despliegues on-premises. Empresas en LATAM que implementen autenticación FIDO2 en infraestructura interna deben evaluar inmediatamente su exposición, especialmente en sectores financiero, gubernamental y de telecomunicaciones.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Submariner: inyección de configuración en modo cert-auth

Se identificó una falla en Submariner que permite inyección de configuración arbitraria en modo autenticación por certificados. Un cluster malicioso puede explotar esta vulnerabilidad publicando un CableName con saltos de línea y directivas de ipsec.conf sin validación previa, comprometiendo la seguridad de redes híbridas y multi-cluster. El impacto afecta directamente a empresas en LATAM con infraestructuras Kubernetes distribuidas en cloud público y privado.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Joro framework: exposición de API local sin autenticación

Joro, un framework de pruebas web, presenta una vulnerabilidad crítica (CVSS 9.6) en versiones anteriores a 1.1.1 que expone una API local sin autenticación en 127.0.0.1:9090 con política CORS permisiva. Un atacante puede ejecutar JavaScript malicioso desde cualquier sitio visitado para cargar plugins nativos y comprometer completamente el sistema. Esta exposición afecta principalmente a equipos de seguridad y desarrolladores que utilizan Joro para análisis de aplicaciones web en infraestructuras empresariales de LATAM.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20279] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are g…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20274] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20212] A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an u…

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-53611] Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary…

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-77009] The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console,…

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-4357] The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files vi…

The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files via the plugin, as well as what can be uploaded, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2025-9314] The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload…

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-73475] Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue…

Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica de XSS almacenado en SiYuan anterior a v3.8.2 permite robo de tokens API

SiYuan versiones anteriores a v3.8.2 contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el servidor de activos debido a una lista de bloqueo de extensiones incompleta. Atacantes pueden cargar archivos con extensiones como .xht, .ehtml, .xsl, .xbl o .rdf que se resuelven como tipos de medios ejecutables, permitiendo ejecutar JavaScript para robar tokens API y comprometer espacios de trabajo. El CVSS de 9.0 indica severidad crítica con alto impacto en confidencialidad e integridad.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Craft CMS anterior a 5.10.11 permite escalación de privilegios

Craft CMS versiones anteriores a 5.10.11 no valida correctamente la bandera de administrador durante el registro de usuarios, permitiendo que atacantes hereden permisos administrativos registrándose con direcciones de correo de cuentas administrador desactivadas. Esta vulnerabilidad afecta especialmente a instancias con registro público habilitado y verificación de correo desactivada, exponiendo sistemas de gestión de contenidos en empresas mexicanas y latinoamericanas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-81286] Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

Unauthenticated SQL Injection in WCFM Marketplace

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-81294] Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

Unauthenticated Privilege Escalation in Authorizer

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-78657] The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletio…

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-9055] The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerab…

The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update endpoint, which allows customers to set their role to 'manager' and trigger creation of a WordPress user with the wpamelia-manager role when t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84699] Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local ac…

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticated attackers can reset local account passwords and authenticate as those users to gain unauthorized access.

nvdcriticovulnerabilidad CVSS 9.1 NVD