Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77543] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77545] A malicious actor with access to the network, low privileges and under certain conditions could expl…

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-59683] The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system …

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of CVE-2026-59682). This allows either a full system compromise from local or remote (if the daemon is running as root) or a full account takeover (if the daemon is running in user context).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77534] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77535] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77536] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77537] A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit…

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77539] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77540] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-59682] Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0…

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80235] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthe…

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77533] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-18431] The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and inclu…

The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-58095] mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for…

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-58096] LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the…

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-19632] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.1 via the 'trp_get_translations_regular' AJAX action. This makes it possible for unauthenticated attackers to extract the raw administrator password-reset URL — including the plaintext reset key and login parameters sto…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en TOTOLINK N600R 4.3.0cu.7647_B20210106

Se ha identificado una vulnerabilidad de desbordamiento de búfer en pila (stack-based buffer overflow) en el controlador CGI del router TOTOLINK N600R versión 4.3.0cu.7647_B20210106. La falla reside en la función setSystemConfig del archivo /cgi-bin/cstecgi.cgi y puede ser explotada remotamente manipulando el parámetro Hostname. Con CVSS 10.0, esta vulnerabilidad permite ejecución de código remoto sin autenticación y afecta a equipos de red en empresas, ISPs y centros de datos en toda Latinoamérica.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

25/08/2026

Vulnerabilidad crítica en ClipBucket V5: ejecución de comandos arbitrarios en instalador web

El instalador web de ClipBucket V5 no valida correctamente el parámetro php_cli_filepath, permitiendo que atacantes no autenticados ejecuten comandos arbitrarios con privilegios del servidor web mediante una solicitud POST maliciosa. Afecta principalmente a plataformas de video hosting y streaming implementadas en datacenters de LATAM sin actualizaciones de seguridad.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-16639] Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalizatio…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationalization Single Sign-On versions: from 0.0.0 to 1.8.0.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-65637] Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. …

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121, which fix the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD