Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-20315] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Wo…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20315 are related to improper access control issues that are …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-20317] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Wo…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20317 are related to improper authentication issues that are …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-20030] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20030 are related to improper neutralization of special elements us…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62667] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16819] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of serv…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-71961] Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that a…

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-71960] Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnera…

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate cr…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-49253] electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3…

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. In src/app/server/zmodem.js, prepareReceiveFile() joins the filename to the user-selected save path, and in src/app/server/trzsz.js, getUniqueFilePath(), the openSaveFile() callback,…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-49255] electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3…

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, and a victim can cause that filename…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-47187] SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue …

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local filesystem. The documented transform_symlinks mitigation does not contain relative targets because transform…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-44829] Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling …

Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling in pkg/modules/api/context.go uses filepath.Base on Linux, which does not treat backslashes as path separators, so a multipart filename containing Windows-style parent directory components survives sanitization. The original filename flows through ctx.diskToOriginal and the multi-output PDF routes i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16706] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16817] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16818] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-15078] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16690] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-14970] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registrat…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-15061] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote a…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-15065] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security r…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to bypass security restrictions due to the exposure of intermediate certificate authority private keys in a publicly available update file.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-15068] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to exe…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

nvdcriticovulnerabilidad CVSS 9.9 NVD