Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77535] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77536] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77537] A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit…

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77538] A malicious actor with access to the network could exploit an Improper Access Control vulnerability …

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77539] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77540] A malicious actor with access to the network and high privileges could exploit an Improper Input Val…

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS Server to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-18794] The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory re…

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19042] A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.8…

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-16444] Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.8…

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80235] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthe…

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80237] EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authent…

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77533] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80233] CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File U…

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-78236] An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a…

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-18884] The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby'…

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-75797] The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it …

The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19760] The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Sit…

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This req…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-58095] mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for…

mp_Enddisc() used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result buffer. A malicious PPP peer can crash ppp(8) or potentially execute arbitrary code as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-58096] LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the…

LcpDecodeConfig() did not validate the length of received endpoint discriminator options against the minimum required by RFC 1717. Undersized options would trigger an out-of-bounds write. A malicious PPP peer can exploit CVE-2026-58095 and CVE-2026-58096 to crash ppp(8) or potentially execute arbitrary code as root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74851] The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its …

The Pods WordPress plugin before 3.3.9.1 does not correctly compare a display callback against its list of blocked functions, allowing users with the author role and above to execute arbitrary code on the server. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

nvdaltovulnerabilidad CVSS 7.2 NVD