Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-63559] An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a …

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-18064] An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) ap…

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-38709] TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR300…

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12562] The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug int…

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that power…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-68500] Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.…

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-68502] LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15…

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-68503] LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.15…

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66418] OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent…

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66803] Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne…

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-52539] Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environmen…

Outstatic CMS

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-35847] An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping …

An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69933] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69934] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69935] CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and reven…

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69936] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69937] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpo…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69938] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the param…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69941] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=…

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69947] SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2025-69930] CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.…

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.

nvdcriticovulnerabilidad CVSS 9.8 NVD