Alertas de Seguridad de la Información

F Medio vulnerabilidad

14/07/2026

Cross-Site Scripting in Domain parameter

Fortinet PSIRT publica advisory de seguridad: Cross-Site Scripting in Domain parameter. Tipo: Cross-Site Scripting (XSS). Producto afectado: Fortisiem.

firewall PAN PSIRT

F Medio vulnerabilidad

14/07/2026

Header injection in Web Filter warning page

Fortinet PSIRT publica advisory de seguridad: Header injection in Web Filter warning page. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Header injection in captive portal authentication form

Fortinet PSIRT publica advisory de seguridad: Header injection in captive portal authentication form. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Missed certificate verification in AD Connector communication with FortiClient EMS

Fortinet PSIRT publica advisory de seguridad: Missed certificate verification in AD Connector communication with FortiClient EMS. Tipo: Vulnerabilidad de seguridad. Producto afectado: Forticlient.

firewallforticlient PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Out of bounds read in GUI

Fortinet PSIRT publica advisory de seguridad: Out of bounds read in GUI. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortiauthenticator.

firewall PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Path traversal in CLI command allows deletion of root file system

Fortinet PSIRT publica advisory de seguridad: Path traversal in CLI command allows deletion of root file system. Tipo: Path Traversal. Producto afectado: Fortios.

firewallfortiospath-traversal PAN PSIRT

F Medio vulnerabilidad

14/07/2026

SSL-VPN Reflected XSS

Fortinet PSIRT publica advisory de seguridad: SSL-VPN Reflected XSS. Tipo: Cross-Site Scripting (XSS). Producto afectado: Fortios.

firewallfortios PAN PSIRT

F Alto vulnerabilidad

14/07/2026

Stack Buffer Overflow in Log Report

Fortinet PSIRT publica advisory de seguridad: Stack Buffer Overflow in Log Report. Tipo: Desbordamiento de Búfer. Producto afectado: Fortios.

firewallfortiosbuffer-overflow PAN PSIRT

F Medio vulnerabilidad

14/07/2026

Supers override fails to properly override supervisor address

Fortinet PSIRT publica advisory de seguridad: Supers override fails to properly override supervisor address. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisiem.

firewall PAN PSIRT

F Crítico vulnerabilidad

14/07/2026

Unauthenticated VNC access exposed on all interfaces

Fortinet PSIRT publica advisory de seguridad: Unauthenticated VNC access exposed on all interfaces. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisandbox.

firewallfortisandbox PAN PSIRT

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56155] Vulnerabilidad explotada activamente en Microsoft Active Directory Federation Services

CISA confirma explotación activa de una vulnerabilidad en Microsoft Active Directory Federation Services. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-28.

explotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56164] Vulnerabilidad explotada activamente en Microsoft SharePoint Server

CISA confirma explotación activa de una vulnerabilidad en Microsoft SharePoint Server. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-17.

explotación activavulnerabilidad CISA KEV

S Alto vulnerabilidad

14/07/2026

[CVE-2026-15409] Vulnerabilidad explotada activamente en SonicWall SMA1000 Appliances

CISA confirma explotación activa de una vulnerabilidad en SonicWall SMA1000 Appliances. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-17.

sonicwallexplotación activavulnerabilidad CISA KEV

S Alto vulnerabilidad

14/07/2026

[CVE-2026-15410] Vulnerabilidad explotada activamente en SonicWall SMA1000 Appliances

CISA confirma explotación activa de una vulnerabilidad en SonicWall SMA1000 Appliances. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-17.

sonicwallexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

13/07/2026

[CVE-2026-58101] Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer derefer…

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller inv…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-58102] Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certi…

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes w…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57855] Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/b…

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including bucke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57856] Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/…

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php sanitizes the bucket name with preg_replace('/[^a-zA-Z0-9-_\\.]/','', $bucket), which permits '..' and '../' sequences. The sanitized value is interpolated into a Flysystem path as uploads://buckets/{bucket}. Flysystem's WhitespacePathN…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

13/07/2026

[CVE-2026-62240] CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url functi…

CrewAI before 1.15.1 contains a server-side request forgery vulnerability in the validate_url function that performs one-shot DNS resolution and blocklist checks before returning the original URL unchanged. Attackers can bypass the security filter by supplying URLs that redirect to internal addresses or use DNS rebinding techniques to access internal services and cloud metadata endpoints.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-62242] Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allo…

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can force the server to make HTTP requests to arbitrary internal addresses and retrieve response bodies via…

nvdaltovulnerabilidad CVSS 8.6 NVD