Alertas de Seguridad de la Información

F Crítico vulnerabilidad

12/08/2026

Broken access control in the RADIUS type admin group

Fortinet PSIRT publica advisory de seguridad: Broken access control in the RADIUS type admin group. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortiweb.

firewallfortiweb PAN PSIRT

F Crítico vulnerabilidad

12/08/2026

Content-Encoding WAF Evasion

Fortinet PSIRT publica advisory de seguridad: Content-Encoding WAF Evasion. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortiweb.

firewallfortiweb PAN PSIRT

F Crítico vulnerabilidad

12/08/2026

FGFM Authentication Weakening via CLI Configuration

Fortinet PSIRT publica advisory de seguridad: FGFM Authentication Weakening via CLI Configuration. Tipo: Bypass de Autenticación. Producto afectado: Fortigate.

firewallfortigateauth-bypass PAN PSIRT

F Crítico vulnerabilidad

12/08/2026

Heap overflow in kernel driver due to missing size validation

Fortinet PSIRT publica advisory de seguridad: Heap overflow in kernel driver due to missing size validation. Tipo: Desbordamiento de Heap. Producto afectado: Forticlient.

firewallforticlient PAN PSIRT

F Medio vulnerabilidad

12/08/2026

Server-Side Request Forgery (SSRF)

Fortinet PSIRT publica advisory de seguridad: Server-Side Request Forgery (SSRF). Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisiem.

firewall PAN PSIRT

F Crítico vulnerabilidad

12/08/2026

Stack buffer overflow in WAD

Fortinet PSIRT publica advisory de seguridad: Stack buffer overflow in WAD. Tipo: Desbordamiento de Búfer. Producto afectado: Fortios.

firewallfortiosbuffer-overflow PAN PSIRT

F Crítico vulnerabilidad

12/08/2026

UI DoS attack

Fortinet PSIRT publica advisory de seguridad: UI DoS attack. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.

firewallfortios PAN PSIRT

M Alto vulnerabilidad

11/08/2026

[CVE-2026-67558] The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a…

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66154] An insufficient certificate validation in a privileged communication workflow, was identified in a G…

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73224] electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3…

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell com…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-18693] An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user wi…

An issue in MongoDB Server's handling of timeseries collections could allow an authenticated user with write privileges to cause an internal data structure to become inconsistent through certain document insertions. A subsequent insert into the affected bucket could then result in the server accessing memory outside its intended bounds, potentially causing a server crash (denial of service), expos…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-69102] MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in appli…

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the publicly known default secret, submit it to the /sign/login/jwt/trust endpoint, and…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62818] Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to exe…

Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-53413] Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may a…

Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-53415] Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve …

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19546] A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.…

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72922] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/backend/backend/api/features/integrations/router.py webhook_ingress_generic route selected get_webhook_manager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webho…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/08/2026

Vulnerabilidad alta de control de acceso en BadChoice Handesk permite corrupción de registros

Una falla de control de acceso en BadChoice Handesk (desde 2026-07-10) permite que cualquier agente autenticado sobrescriba registros de clientes potenciales de otros equipos mediante el endpoint LeadsController@update sin validación de autorización. Los atacantes internos pueden modificar masivamente datos de leads, comprometiendo procesos de ventas y CRM en empresas de México y LATAM que usen esta plataforma. El riesgo es alta (CVSS 8.1) en organizaciones con múltiples equipos de ventas compartiendo la instancia.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-10579] A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged …

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15554] the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any sh…

the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.

nvdaltovulnerabilidad CVSS 7.4 NVD