Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/08/2026

[CVE-2026-54083] Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints an…

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The  ip-customblock  active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files on the filesystem as root. The script builds a file path by concatenating the  srcip  field taken from alert JSON directly onto the fixed  /ip…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-54330] Ceph is an open-source distributed storage platform providing object, block, and file storage. In ve…

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed header set, allowing anyone holding a presigned URL to attach arbitrary unsigned x-amz-* headers that RGW will honor. AWS S3 requires every x-amz-…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81730] Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message…

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollecto…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81529] Improper neutralization of delimiters in connection-URL construction allows connection-option inject…

Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C# Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is serialized without neutralizing the URL/option delimiters and is then re-parsed as authoritative connec…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81522] A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows spec…

A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without validating it may therefore have its operation directed at a different target than intended. This can result in limited unauthorized read and write access to data belonging to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-54721] Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4…

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81735] startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::…

startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-ser…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81719] openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the …

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81701] openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing …

openssl_encrypt versions before 1.4.9 use a denylist to identify trusted built-in plugins, allowing unsigned plugins in top-level plugins/ directories and unknown subdirectories to bypass signature verification. Attackers can place malicious unsigned plugins following documented installation paths to achieve arbitrary code execution in the CLI process with access to passwords and cryptographic key…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81683] openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client privat…

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file, keeps onl…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81335] Baserow dispatches an Application Builder data source without acting on the result of its permission…

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission class that admits any caller, so a request carrying no credential reaches the handler. DataSourceService.dispatch_data_sources in backend/src/baserow/contrib/bui…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81098] The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller cre…

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch f…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81094] The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only whe…

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. The serve command in apps/cli/src/commands/serve.ts defaulted its host to the all-interfaces address on a fixed port, and required a token only when the corresponding flag was supplied, so a default invocation exposed the aggregator, and every MCP server it fronted, to a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-81096] ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that req…

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the python_code_executor tool, in python_executor_tool.py, inspected the submitted source for a denied list of attribute names and calls but left the attribute-lookup builtins available and did not stop a dunder attribute reached through a string lookup o…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-80208] APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in Interna…

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated cli…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-34674] Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulner…

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-74232] Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1…

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG721B firmware 19.0809, HK300 firmware 1.0.0.2.032, and MAP-N10 firmware 1.0.0.2.04…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81036] Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in…

Stalwart Mail Server does not compare an OAuth redirect target against any registered destination in its default configuration. The validation routine in crates/http/src/auth/oauth/registration.rs returns success immediately when the client-authentication requirement is disabled, and that requirement is false in the shipped settings, so the supplied redirect value is neither matched against a regi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81031] IDURAR ERP CRM changes the password of whichever account a request names rather than the account mak…

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and ne…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80427] bestzip builds the argument list for the system zip utility without separating options from operands…

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name t…

nvdaltovulnerabilidad CVSS 8.4 NVD