Alertas de Seguridad de la Información

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-63456] Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow…

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2025-29296] H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R0…

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (de…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-69098] kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection e…

kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can exploit this to override the __type__ field with subprocess.check_output and arbitrary arguments, achieving remote code execution with appli…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-69110] OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthentic…

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can retrieve intermediate audio, video artifacts, and subtitles belonging to other users' jobs, and additionall…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-25289] Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Disco…

Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-61514] Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability t…

Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can exploit the unvalidated Session field in the proprietary control protocol header to access live video streams, control pan and tilt motors, ac…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-61515] Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vul…

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary com…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

Vulnerabilidad crítica en HUMANIST Digital Human Resources por clave criptográfica codificada

Se detectó una vulnerabilidad de severidad alta (CVSS 9.1) en HUMANIST Digital Human Resources versiones 26.0 anteriores a 26.1, que permite a atacantes leer constantes sensibles dentro del ejecutable mediante claves criptográficas hardcodeadas. Esto expone credenciales y datos confidenciales de recursos humanos en empresas de México y LATAM. La vulnerabilidad afecta principalmente a organizaciones que usan este sistema para gestión de nómina y personal.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/08/2026

Vulnerabilidad crítica en HUMANIST Digital Human Resources: almacenamiento en texto plano e inyección SQL

HUMANIST Digital Human Resources (versiones 26.0 a 26.0.x) contiene una vulnerabilidad crítica (CVSS 9.8) que permite el almacenamiento de información sensible en texto plano y inyección SQL. Esta falla afecta directamente sistemas de gestión de recursos humanos en empresas LATAM, exponiendo credenciales, datos de nómina y información personal de empleados. La vulnerabilidad es explotable remotamente sin autenticación previa.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

Vulnerabilidad crítica de carga de archivos peligrosos en HUMANIST Digital Human Resources

HUMANIST Digital Human Resources (versiones 26.0 a 26.0.x) contiene una vulnerabilidad de carga sin restricciones que permite a atacantes subir shells web al servidor. Esta falla afecta directamente a departamentos de Recursos Humanos en México y LATAM que gestionen nómina y datos sensibles de empleados. El CVSS 9.8 indica riesgo crítico de compromiso total del sistema.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

Clave RSA estática incrustada en firmware afecta servidores Lighttpd (CVE-2026-18753)

Firmware de múltiples fabricantes contiene una clave privada RSA estática utilizada por el servidor web Lighttpd para terminación TLS. Su exposición permite a atacantes descifrar tráfico HTTPS, suplantar servidores y comprometer la confidencialidad e integridad de comunicaciones. Afecta especialmente infraestructuras de borde y dispositivos IoT en datacenters LATAM.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/08/2026

Clave RSA privada incrustada en firmware afecta servidores Lighttpd (CVE-2026-18754)

El firmware de múltiples dispositivos contiene una clave RSA privada estática utilizada por el servidor web Lighttpd para terminación TLS. La exposición de esta clave permite a atacantes descifrar comunicaciones HTTPS, suplantar servidores y comprometer la confidencialidad e integridad de datos sensibles en tránsito. Impacta infraestructuras críticas y plataformas de comercio electrónico en LATAM que dependen de este servicio web.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-16618] The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking …

The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achieve remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-15958] The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization check…

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the connected Dropbox account and to read the connected account and administrator email addresses.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-18685] A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the functio…

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure and confirmed the existence of t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-18686] A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function …

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48323] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48326] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48330] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this is…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48331] Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that …

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD