Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62666] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62667] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read keyData[scopes] and returns the owning user's complete identity. AbstractApiController::requirePermission() consequently evaluates the full user…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62669] Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Gra…

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the r…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-71960] Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnera…

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate cr…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53451] Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad alta en semctl(2) permite acceso no autorizado a semáforos del sistema

Una falla en los comandos GETALL y SETALL de semctl(2) permite que atacantes locales manipulen semáforos del kernel entre ciclos de creación/destrucción, explotando un desbordamiento de secuencia tras 0x8000 operaciones. Afecta sistemas Unix/Linux en producción que ejecutan aplicaciones multi-proceso con semáforos del sistema operativo, comprometiendo la integridad de sincronización en bases de datos y middleware alta.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-49422] The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace…

The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to fr…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18051] The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it use…

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can stri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17565] The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied …

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad alta en plugin Atarim para WordPress permite eliminación arbitraria de archivos

El plugin Atarim para WordPress (versiones hasta 5.1.1) contiene una falla de validación de rutas de archivo que permite a atacantes autenticados con nivel de autor eliminar archivos arbitrarios del servidor. Afecta principalmente a agencias digitales y estudios de diseño en LATAM que utilizan este plugin para gestión de contenido y feedback de clientes. La vulnerabilidad requiere acceso autenticado pero representa riesgo alta en entornos multiusuario.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

19/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en UTT HiPER 1200GW hasta versión 2.5.3-170306

Se ha identificado una debilidad en los equipos UTT HiPER 1200GW (versiones hasta 2.5.3-170306) que permite un desbordamiento de búfer basado en pila mediante manipulación remota del parámetro 'timestart' en la función strcpy del archivo /goform/formGroupConfig. Con puntuación CVSS 9.9, este dispositivo ampliamente utilizado en redes corporativas de LATAM como gateway de seguridad es vulnerable a ejecución remota de código. El exploit está disponible públicamente, elevando significativamente el riesgo de compromiso.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

19/08/2026

Vulnerabilidad crítica en UTT HiPER 1250GW permite ejecución remota de código (CVE-2026-76004)

Se ha identificado una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en UTT HiPER 1250GW versiones hasta 3.2.7-210907-180535. El fallo existe en el manejador HTTP del formulario /goform/aspApBasicConfigUrcp y puede ser explotado remotialmente sin autenticación manipulando el parámetro pvid. El exploit está públicamente disponible, poniendo en riesgo crítico los equipos desplegados en infraestructuras de ISPs, centros de datos y operadores de telecomunicaciones en América Latina.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71141] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The …

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71131] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The …

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71101] Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax …

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Orac…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71104] Vulnerability in the Oracle HRMS (Netherlands) product of Oracle E-Business Suite (component: Nether…

Vulnerability in the Oracle HRMS (Netherlands) product of Oracle E-Business Suite (component: Netherlands Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HRMS (Netherlands). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (Netherland…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71106] Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Appl…

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet). Supported versions that are affected are 5.6.28.0-5.6.28.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services. Successful attacks require human interaction fr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71045] Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The su…

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can r…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71034] Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O…

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerabi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-71035] Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of O…

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnera…

nvdaltovulnerabilidad CVSS 8.1 NVD