Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47632] Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate pr…

Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59841] A improper restriction of communication channel to intended endpoints vulnerability in Fortinet Fort…

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59835] A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, F…

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.

nvdaltovulnerabilidad CVSS 8.6 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59836] A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, Fort…

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2025-53379] A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenti…

A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2024-7708] For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer…

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Medio vulnerabilidad

14/07/2026

Buffer overread in authd and wad daemon

Fortinet PSIRT publica advisory de seguridad: Buffer overread in authd and wad daemon. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Medio vulnerabilidad

14/07/2026

Cross-Site Scripting in Domain parameter

Fortinet PSIRT publica advisory de seguridad: Cross-Site Scripting in Domain parameter. Tipo: Cross-Site Scripting (XSS). Producto afectado: Fortisiem.

firewall PAN PSIRT

F Medio vulnerabilidad

14/07/2026

Header injection in Web Filter warning page

Fortinet PSIRT publica advisory de seguridad: Header injection in Web Filter warning page. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Header injection in captive portal authentication form

Fortinet PSIRT publica advisory de seguridad: Header injection in captive portal authentication form. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Missed certificate verification in AD Connector communication with FortiClient EMS

Fortinet PSIRT publica advisory de seguridad: Missed certificate verification in AD Connector communication with FortiClient EMS. Tipo: Vulnerabilidad de seguridad. Producto afectado: Forticlient.

firewallforticlient PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Out of bounds read in GUI

Fortinet PSIRT publica advisory de seguridad: Out of bounds read in GUI. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortiauthenticator.

firewall PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Path traversal in CLI command allows deletion of root file system

Fortinet PSIRT publica advisory de seguridad: Path traversal in CLI command allows deletion of root file system. Tipo: Path Traversal. Producto afectado: Fortios.

firewallfortiospath-traversal PAN PSIRT

F Medio vulnerabilidad

14/07/2026

SSL-VPN Reflected XSS

Fortinet PSIRT publica advisory de seguridad: SSL-VPN Reflected XSS. Tipo: Cross-Site Scripting (XSS). Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Alto vulnerabilidad

14/07/2026

Stack Buffer Overflow in Log Report

Fortinet PSIRT publica advisory de seguridad: Stack Buffer Overflow in Log Report. Tipo: Desbordamiento de Búfer. Producto afectado: Fortios.

firewallfortiosbuffer-overflow PAN PSIRT

F Medio vulnerabilidad

14/07/2026

Supers override fails to properly override supervisor address

Fortinet PSIRT publica advisory de seguridad: Supers override fails to properly override supervisor address. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisiem.

firewall PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Unauthenticated VNC access exposed on all interfaces

Fortinet PSIRT publica advisory de seguridad: Unauthenticated VNC access exposed on all interfaces. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisandbox.

firewallfortisandbox PAN PSIRT

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-58102] Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certi…

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes w…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59801] 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a…

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15683] Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulne…

Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability. The specific flaw exists within the device management functionality. The issu…

nvdaltovulnerabilidad CVSS 7.5 NVD