Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-45699] Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.…

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-49457] erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not au…

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could pr…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-73849] Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=r…

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19635] A local privilege escalation vulnerability exists in Security Center. An attacker with write access …

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66271] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-63700] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permissio…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66270] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-69101] Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authen…

Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a m…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad alta en File Browser permite acceso no autorizado a archivos de otros usuarios

File Browser versiones anteriores a 2.63.20 contiene una falla de aislamiento en los mecanismos de autenticación por proxy y auto-aprovisionamiento de usuarios. Atacantes con credenciales válidas pueden leer, modificar, eliminar y compartir archivos de otros usuarios al explotar la asignación del scope raíz del servidor. Esta vulnerabilidad afecta especialmente a organizaciones en LATAM que despliegan File Browser en entornos multi-usuario o en arquitecturas de proxy.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

Regresión de autorización en Budibase 3.39.4-3.40.0 expone URLs firmadas de Amazon S3

Budibase versiones 3.39.4 anteriores a 3.40.0 contienen un fallo de control de acceso en el endpoint de carga de adjuntos S3. Usuarios con permisos BASIC pueden obtener URLs presignadas PutObject de buckets S3 arbitrarios, permitiendo escritura no autorizada en almacenamiento en la nube. Afecta directamente a empresas en LATAM que usan Budibase para gestión de contenidos y datos empresariales.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en getgrav/grav-plugin-api: escalada de privilegios en desactivación de 2FA

El paquete Composer getgrav/grav-plugin-api versiones

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

Plugin Grav API: bypas de restricción de scopes en endpoint de reportes (CVE-2026-72825)

El plugin getgrav/grav-plugin-api anterior a versión 1.0.13 contiene una vulnerabilidad que permite eludir las restricciones de scope de API keys. Un atacante con credenciales de API limitadas puede ejecutar operaciones de configuración a nivel administrador en el endpoint POST /reports/twig-content/allowlist, comprometiendo la integridad de sistemas Grav en producción. Afecta especialmente a plataformas de contenido desplegadas en México y LATAM que exponen APIs internas.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite escalación de privilegios

El plugin getgrav/grav-plugin-api anterior a la versión 1.0.13 no valida correctamente que los permisos de nuevas claves API sean un subconjunto de los permisos del solicitante. Un atacante con una clave API de bajo privilegio puede crear claves con permisos elevados, comprometiendo aplicaciones Grav alojadas en México y Latinoamérica. Esta vulnerabilidad afecta directamente portales de contenido, sistemas de gestión documental y plataformas educativas que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73842] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73658] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResourc…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73659] Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.…

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and generatePresignedRequest in apps/webapp/app/v3/objectStore.server.ts, allowing .. traversal to escape the packets/

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73305] Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal…

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72850] Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to…

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72851] Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered …

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72855] Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import …

Budibase before 3.40.0 contains server-side request forgery vulnerabilities in OpenAPI query import and REST query execution that allow authenticated builder-level users to bypass DNS pinning protections through DNS rebinding attacks. Attackers can configure hostnames that resolve to public addresses during validation but resolve to loopback or private addresses during actual connection, allowing …

nvdaltovulnerabilidad CVSS 8.5 NVD