Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta en openssl_encrypt: clave secreta hardcodeada compromete autenticación de API

Versiones de openssl_encrypt anteriores a 1.4.0 contienen una clave secreta predeterminada hardcodeada en la configuración del servidor de telemetría, usada para hash de claves API. Atacantes que conocen este valor pueden falsificar hashes de API para comprometer la autenticación del sistema de telemetría. Esto afecta directamente a infraestructuras en la nube y servidores locales que dependen de esta validación criptográfica.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta en openssl_encrypt: secretos JWT hardcodeados permiten falsificación de tokens

Versiones de openssl_encrypt anteriores a 1.4.0 contienen secretos de firma JWT hardcodeados en config.py que superan validaciones, permitiendo a atacantes con acceso al código fuente forjar tokens válidos para cualquier client_id y acceder sin autorización a APIs de keyserver y telemetría. Afecta especialmente a organizaciones en LATAM que utilizan esta librería en aplicaciones de autenticación y gestión de claves.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta de path traversal en openssl_encrypt anteriores a v1.4.0

openssl_encrypt versiones anteriores a 1.4.0 contienen una vulnerabilidad de path traversal (CVE-2026-74884, CVSS 7.5) en el método _is_safe_path que no sanitiza el parámetro plugin_id, permitiendo a atacantes acceder a directorios arbitrarios fuera del directorio de plugins mediante secuencias como '../'. Empresas en México y LATAM que usen este componente en aplicaciones web o sistemas de gestión de contenido enfrentan riesgo de exposición de información sensible y potencial ejecución de código.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

Vulnerabilidad alta en openssl_encrypt: derivación de claves débil permite cracking de contraseñas (CVE-2026-74888)

openssl_encrypt versiones anteriores a 1.4.0 implementan una construcción PBKDF2 no estándar con iteraciones=1 por llamada, debilitando significativamente la derivación de claves. Atacantes pueden comprometer archivos cifrados legacy con esfuerzo computacional reducido. Afecta sistemas que protegen datos financieros, médicos y personales en empresas mexicanas y latinoamericanas que usan esta librería para cifrado de datos en reposo.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74877] openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the …

openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74879] openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready …

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74882] openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the enti…

openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74883] openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbo…

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74868] SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service…

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74869] stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message hand…

stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any server's member-update topic by sending a Subscribe message with an arbitrary server ID, receiving live UserUpdate events including display n…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74874] openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographi…

openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624 outputs and predict pixel locations containing hidden data for extraction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74801] SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-lin…

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion flow to execute arbitrary commands with administrator privileges after UAC approval.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74802] SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-onl…

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attac…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74798] SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. …

SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds a filesystem path via filepath.Join without validating that id matches SiYuan's node-ID format. An authenticated MCP client can supply path t…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-74845] Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulner…

Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19982] A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability af…

A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explain…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19983] A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE…

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgra…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19980] A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE930…

A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated re…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19981] A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A weakness has been identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. This affects an unknown part of the component Wi-Fi Timer Power-Schedule Feature. Executing a manipulation of the argument switch_power/restore_power can lead to os command injection. The attack can be launc…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19979] A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "…

nvdaltovulnerabilidad CVSS 8.3 NVD