Alertas de Seguridad de la Información

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74875] openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema libra…

openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74799] SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps w…

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-74800] SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when servin…

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace owner opens the asset link.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74801] SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-lin…

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74802] SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-onl…

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attac…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74798] SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. …

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path t…

nvdaltovulnerabilidad CVSS 8.7 NVD

A Alto vulnerabilidad

17/08/2026

iOS 26.6.1 (23G83)

Apple lanza actualización de seguridad para iOS versión 26.6.1. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-moviliosiphone Apple Security

A Alto vulnerabilidad

17/08/2026

iPadOS 26.6.1 (23G83)

Apple lanza actualización de seguridad para iPadOS versión 26.6.1. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilipadosipad Apple Security

A Alto vulnerabilidad

17/08/2026

visionOS 26.6.1 (23O780)

Apple lanza actualización de seguridad para visionOS versión 26.6.1. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilvisionos Apple Security

A Alto vulnerabilidad

17/08/2026

macOS 26.6.2 (25G83)

Apple lanza actualización de seguridad para macOS versión 26.6.2. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilmacos Apple Security

A Alto vulnerabilidad

17/08/2026

iOS 18.7.10 (22H374)

Apple lanza actualización de seguridad para iOS versión 18.7.10. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-moviliosiphone Apple Security

A Alto vulnerabilidad

17/08/2026

iPadOS 18.7.10 (22H374)

Apple lanza actualización de seguridad para iPadOS versión 18.7.10. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilipadosipad Apple Security

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

? Crítico alerta

17/08/2026

CISA Adds One Known Exploited Vulnerability to Catalog 

CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog . CVEs relacionados: CVE-2025-62593.

cisaus-certalerta CISA KEV

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19982] A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability af…

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explain…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19983] A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE…

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgra…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19980] A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE930…

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated re…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19981] A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launc…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19979] A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

17/08/2026

[CVE-2026-19977] A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function http…

A vulnerability was detected in EFM ipTIME A3004T 14.19.0. The affected element is the function httpcon_check_session_url of the component Session Validation. Performing a manipulation results in improper authentication. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 10.0 NVD