Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/08/2026

[CVE-2026-70485] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 unt…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.is_global to the literal IPv6 address without examining IPv4 addresses embedded in transition encodings. On a deployment with a NAT64 gateway, any verified user could wrap an internal or…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18810] A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of …

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18656] An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remo…

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18657] An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remot…

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-49435] Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauth…

Keysight IxChariot Endpoint and associated products contain a stack-based buffer overflow. An unauthenticated remote attacker can send a specially crafted packet and execute arbitrary code with administrative privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-47623] NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of un…

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to denial of service and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24253] NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds writ…

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-24254] NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attack…

NVIDIA Dynamo for Linux contains a vulnerability in the multimodal serving topology, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18788] A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted eleme…

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-63455] Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow…

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-63456] Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow…

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive information on the target system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18787] A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function r…

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67198] Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatche…

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed requests such as ViewToArrowReq with no viewport set or MakeTableReq with no data field to trigger unwrap() calls on None values at nine dis…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-67200] Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attacke…

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to traverse outside the configured asset root directory and retrieve sensitive files such as system credentials…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-61515] Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vul…

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary com…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18770] A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e…

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-11368] The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer w…

The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent),…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

04/08/2026

Vulnerabilidad crítica en HUMANIST Digital Human Resources por clave criptográfica codificada

Se detectó una vulnerabilidad de severidad alta (CVSS 9.1) en HUMANIST Digital Human Resources versiones 26.0 anteriores a 26.1, que permite a atacantes leer constantes sensibles dentro del ejecutable mediante claves criptográficas hardcodeadas. Esto expone credenciales y datos confidenciales de recursos humanos en empresas de México y LATAM. La vulnerabilidad afecta principalmente a organizaciones que usan este sistema para gestión de nómina y personal.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/08/2026

Vulnerabilidad de session hijacking en HUMANIST Digital Human Resources por uso de GET con parámetros sensibles

HUMANIST Digital Human Resources (versiones 26.0 a 26.1) expone credenciales y tokens de sesión en strings de consulta GET, permitiendo secuestro de sesiones. Afecta a departamentos de Recursos Humanos en empresas de México y LATAM que utilizan este sistema para gestión de nómina y personal. El riesgo alta radica en la facilidad de captura de información sensible en logs de servidor, proxies corporativos e historiales del navegador.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

04/08/2026

Vulnerabilidad crítica en HUMANIST Digital Human Resources: almacenamiento en texto plano e inyección SQL

HUMANIST Digital Human Resources (versiones 26.0 a 26.0.x) contiene una vulnerabilidad crítica (CVSS 9.8) que permite el almacenamiento de información sensible en texto plano y inyección SQL. Esta falla afecta directamente sistemas de gestión de recursos humanos en empresas LATAM, exponiendo credenciales, datos de nómina y información personal de empleados. La vulnerabilidad es explotable remotamente sin autenticación previa.

nvdcriticovulnerabilidad CVSS 9.8 NVD