Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

Vulnerabilidad alta de escalada de privilegios en Reyrolle 7SR5 (CVSS 8.8)

Se ha identificado un fallo en los controles de autorización del lado del servidor en la interfaz de gestión web de Reyrolle 7SR5 en todas las versiones anteriores a V2.70. Un atacante autenticado con permisos bajos puede eludir las restricciones de control de acceso basado en roles (RBAC) manipulando datos de solicitudes para escalar privilegios a nivel administrativo. Esto afecta directamente a infraestructuras altas de distribución eléctrica y subestaciones en LATAM que dependen de estos dispositivos de protección.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-62645] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed …

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-62646] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is…

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-62647] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generat…

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easi…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-62648] A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL c…

A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denia…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-50093] A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), S…

A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this …

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-34223] A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click…

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected applicatio…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81798] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81806] Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side …

Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from n/a through 7.0.09.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84817] Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84818] Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

Unauthenticated Cross Site Scripting (XSS) in Open User Map

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84820] Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons…

Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76561] A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificat…

A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achievi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81781] Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting In…

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81790] Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez…

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-71374] Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affec…

Deserialization of untrusted data vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-71375] Improper restriction of XML external entity reference vulnerability in Cosminexus Component Containe…

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 bef…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-48888] Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows …

Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Medio vulnerabilidad

08/09/2026

CVE-2026-66306 Skype for Business Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-66306 Skype for Business Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

08/09/2026

CVE-2026-66308 Skype for Business and Lync Denial of Service Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-66308 Skype for Business and Lync Denial of Service Vulnerability. Tipo: Denegación de Servicio (DoS).

dos Microsoft MSRC