Alertas de Seguridad de la Información

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66583] Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

Unauthenticated PHP Object Injection in Forminator

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2025-15688] Unauthenticated SQL Injection in Capella <= 2.5.5 versions.

Unauthenticated SQL Injection in Capella

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2025-15689] Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

Unauthenticated Privilege Escalation in Capella

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-13097] A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos pri…

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-11861] A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Dire…

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certifi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-14950] An unauthenticated remote attacker in possession of a valid session identifier is able to continue u…

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-75860] The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verifica…

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76850] LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine…

LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplie…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76404] In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execut…

In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76589] A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 …

A vulnerability was found in TRENDnet TEW-755AP up to 20260702. Affected is the function FUN_401000 of the file /sbin/mycli. The manipulation of the argument ssid results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76590] A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some …

A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76310] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk r…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76311] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow do…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76312] In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-repo…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-76584] A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some…

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set_time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53548] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped loo…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53545] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the DELETE /ssh/tunnel/disconnect/:tunnelName teardown path in src/backend/ssh/tunnel.ts interpolates endpointPort, sourcePort, endpointUsername, and endpointIP into single-quoted pkill -f patterns. An authenticated user who can edit a tunnel host field can include a single…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53546] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-63722] ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthentic…

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to sk…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-55089] Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/AP…

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while src/node/security/OAuth2Provider.ts issues admin: false for configured non-admin users. A non-admin user with a valid s…

nvdcriticovulnerabilidad CVSS 9.9 NVD