Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-76943] Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allo…

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76945] The affected Ebyte device relies on client-managed authentication tokens without sufficient server-…

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-77977] Ebyte gateway product's vendor configuration utility does not require authentication before allowin…

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75813] Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthor…

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75814] The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the…

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76060] An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionalit…

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-76179] An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway produ…

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersona…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75418] A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.…

A path traversal vulnerability exists in the built-in preview/development web server of Lektor

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75419] go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() fun…

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/service/internal/data/data.go and app/app/service/internal/data/data.go returns a no-op authorization engine (noop.State{}), so the authz middleware always allows requests. Any authenticated user (regardless of role or tenant) can invoke administrative APIs such as deleting users,…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-75337] The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to pa…

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75339] The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logge…

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75417] A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() func…

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within application/admin/controller/category.class.php, where the user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization. This allows an authenticated administrator to execute arbitrary SQL queries via boolean-based blind injectio…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-73125] Ebyte device web management interface does not consistently enforce authentication before granting …

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-73809] A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway pro…

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful explo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-71187] The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticat…

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-67560] Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker …

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-69658] MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information t…

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

28/08/2026

[CVE-2026-50152] Ceph is an open-source distributed storage platform providing object, block, and file storage. In ve…

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Monitor subscription handler fails to properly authorize access to the configuration-key store, allowing any CephX user with only  `mon allow r` capabilities to read the entire store by sending a single crafted MMonSubscribe message. The config-key store holds …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-54083] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The  ip-customblock  active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the  srcip  field taken from alert JSON directly onto the fixed  /ip…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-54085] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, r…

nvdaltovulnerabilidad CVSS 7.1 NVD