Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-6952] A post-authentication command injection vulnerability in the "LogServer" field of the syslog compone…

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16332] A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /…

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16329] A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16330] A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function …

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=from_copylink causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16331] A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function…

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/save_ajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-55831] Netty is a network application framework for development of protocol servers and clients. Prior to 4…

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS f…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-55833] Netty is a network application framework for development of protocol servers and clients. Prior to 4…

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16327] A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing o…

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_file/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

W Alto vulnerabilidad

21/07/2026

[CVE-2026-60137] Vulnerabilidad explotada activamente en WordPress Core

CISA confirma explotación activa de una vulnerabilidad en WordPress Core. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-08-04.

wordpressexplotación activavulnerabilidad CISA KEV

W Alto vulnerabilidad

21/07/2026

[CVE-2026-63030] Vulnerabilidad explotada activamente en WordPress Core

CISA confirma explotación activa de una vulnerabilidad en WordPress Core. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

wordpressexplotación activavulnerabilidad CISA KEV

L Alto vulnerabilidad

21/07/2026

[CVE-2026-0770] Vulnerabilidad explotada activamente en Langflow Langflow

CISA confirma explotación activa de una vulnerabilidad en Langflow Langflow. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

langflowexplotación activavulnerabilidad CISA KEV

D Alto vulnerabilidad

21/07/2026

[CVE-2021-27137] Vulnerabilidad explotada activamente en DD-WRT DD-WRT

CISA confirma explotación activa de una vulnerabilidad en DD-WRT DD-WRT. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-24.

dd-wrtexplotación activavulnerabilidad CISA KEV

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15903] Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacke…

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15904] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker …

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15905] Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentia…

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap corruption via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Crítico vulnerabilidad

20/07/2026

[CVE-2026-15899] Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote att…

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

20/07/2026

[CVE-2026-15900] Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker …

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

20/07/2026

[CVE-2026-15901] Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to pote…

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

20/07/2026

[CVE-2026-15902] Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute…

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

20/07/2026

[CVE-2026-64624] FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line opt…

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP files with /rdp2tcp, /cert:ignore, or /drive options to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction.

nvdaltovulnerabilidad CVSS 7.8 NVD