Alertas de Seguridad de la Información

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73300] Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Bu…

Budibase is an open-source low-code platform. Prior to 3.40.0, the MySQL integration component in Budibase is configured with multipleStatements: true, enabling execution of multiple SQL statements in a single query. Attackers can inject malicious SQL commands through user input fields, leading to complete database compromise. This vulnerability is fixed in 3.40.0.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16956] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands d…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-17218] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-o…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16860] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code d…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73296] Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_t…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73294] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi…

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This i…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73263] Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accep…

Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection test accepted kubeconfig_content containing a legacy gcp auth-provider with config.cmd-path and config.cmd-args because kubeconfig_contains_exec_auth in api/src/backend/api/v1/serializers.py checked only exec blocks, and POST /api/v1/providers/{id}/connection loaded it through config.load_kube_config_from_dic…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-50561] Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor…

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment ins…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica de buffer overflow en servicios PROFINET (CVE-2025-41769)

Los dispositivos con servicio PROFINET están expuestos a un buffer overflow en configuración por defecto que permite a atacantes remotos no autenticados ejecutar código arbitrario o reiniciar los equipos. Esta vulnerabilidad afecta principalmente infraestructura industrial, sistemas de automatización y dispositivos IoT en plantas manufactureras, utilities y sectores críticos en LATAM. La ausencia de autenticación requerida amplifica significativamente el riesgo de explotación.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

rce Microsoft MSRC

M Crítico vulnerabilidad

12/08/2026

Inyección SQL ciega crítica en Essekia Tablesome Table versiones hasta 1.2.9

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-66659) en Essekia Tablesome Table que permite a atacantes ejecutar consultas SQL no autorizadas sin necesidad de ver respuestas directas (SQL Injection Ciega). Esta falla afecta a organizaciones en México y Latinoamérica que utilizan este componente para gestión de tablas en aplicaciones web, exponiendo bases de datos críticas a acceso no autorizado, robo de datos sensibles y manipulación de registros.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16051] The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages inst…

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-15039] The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of i…

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en Red Hat Advanced Cluster Management permite robo de tokens de clusters

Se identificó una falla en el componente multicloud-integrations de Red Hat Advanced Cluster Management (RHACM) que permite a usuarios autenticados manipular el controlador GitOpsCluster y redirigir tokens de bearer de clusters spoke hacia namespaces bajo su control. Esta vulnerabilidad (CVSS 9.6) afecta principalmente a empresas en LATAM con infraestructuras multicloud híbridas en Kubernetes, exponiendo credenciales críticas de acceso a recursos en la nube pública y privada.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en multicloud-integrations permite ejecución de comandos en clusters Kubernetes

Se descubrió una falla en el componente multicloud-integrations que permite a un usuario con permisos de creación de Applications en el cluster hub explotar la validación deficiente de anotaciones para dirigirse a clusters Kubernetes arbitrarios. Un atacante podría forzar la sincronización maliciosa de ArgoCD en clusters spoke, comprometiendo la integridad de aplicaciones críticas en infraestructuras multi-nube. Este riesgo es crítico (CVSS 9.9) para empresas en LATAM que gestionan plataformas DevOps centralizadas.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-5917] libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain…

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66147] An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G…

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48765] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator …

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73032] PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e…

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero…

nvdcriticovulnerabilidad CVSS 9.6 NVD