Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16253] The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authori…

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-16294] The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of…

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-14925] The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of it…

The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based dow…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-13613] The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied para…

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-13171] The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-l…

The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta en Velociraptor permite eludir permisos de recolección mediante consultas VQL

Velociraptor presenta una falla de escalación de privilegios que permite a usuarios con rol de analista programar nuevas recolecciones de datos sin poseer el permiso COLLECT_CLIENT requerido. El ataque explota la capacidad de ejecutar consultas VQL arbitrarias para resetear el proveedor de autorización, comprometiendo la cadena de custodia forense y el control de acceso en investigaciones digitales.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta en verificadores de syscall de Zephyr RTOS permite escalada de privilegios

Los verificadores de syscall z_vrfy_zsock_sendmsg() y z_vrfy_zsock_recvmsg() en Zephyr RTOS contienen un defecto de validación donde se captura una copia de estructuras de usuario pero se vuelve a leer la estructura original en vivo para decisiones posteriores. Esto permite a atacantes locales modificar buffers iovec entre verificación y uso, escalando privilegios en sistemas embebidos y IoT. Afecta principalmente a dispositivos industrial IoT, telecomunicaciones y sistemas altas en operación en LATAM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta de autenticación en plugin WordPress Passwordless Login de VentraConnect

El plugin 'Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login' para WordPress (versiones hasta 1.4.3) contiene un fallo de autenticación que permite eludir el acceso mediante verificación insuficiente del correo electrónico devuelto por Spotify. Un atacante podría acceder a cuentas sin credenciales válidas. Afecta directamente a sitios WordPress en México y LATAM que implementen este plugin con autenticación social.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta en Red Hat Advanced Cluster Management permite acceso no autorizado a secretos

Una flaw en el componente multicloud-operators-channel de Red Hat Advanced Cluster Management (RHACM) permite que agentes comprometidos de clústeres gestionados accedan sin autorización a Secrets y ConfigMaps en namespaces de Channel, exponiendo credenciales de Git, Helm y otros servicios de múltiples tenants. El impacto es alta en entornos multicloud híbridos comunes en empresas de LATAM que utilizan RHACM para orquestar infraestructura en AWS, Azure y plataformas on-premise.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/08/2026

CVE-2026-66878: Vulnerabilidad de divulgación de información en multicloud-operators-subscription

Se ha identificado una falla en multicloud-operators-subscription que permite a administradores de namespace con privilegios acceder a secretos almacenados en otros espacios de nombres mediante manipulación del campo Channel.Spec.SecretRef.Namespace. Esta vulnerabilidad (CVSS 7.7) expone credenciales, tokens API y datos sensibles en entornos multicloud comúnmente utilizados en infraestructuras híbridas de empresas latinoamericanas. El riesgo se amplifica en organizaciones con múltiples equipos compartiendo clusters Kubernetes.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta en UEFI por falta de verificación de arranque seguro

Una vulnerabilidad en firmware UEFI (CVE-2026-6484, CVSS 8.2) permite la ejecución arbitraria de código debido a la ausencia de verificación criptográfica en ciertos módulos de firmware (FV). Esta falla compromete la cadena de confianza de arranque en servidores, estaciones de trabajo y dispositivos empresariales, siendo particularmente alta en infraestructuras cloud y centros de datos en LATAM donde el firmware no parchado es común.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73246] Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/s…

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73247] Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/mai…

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that ac…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73249] calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update…

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66875] In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attac…

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-67558] The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a…

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-29036] cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability …

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to app…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66149] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur…

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66150] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur…

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66154] An insufficient certificate validation in a privileged communication workflow, was identified in a G…

An insufficient certificate validation in a privileged communication workflow, was identified in a GMS application 9.5.1 (Build 9510.1044) and earlier versions which, under a successful MitM attack and controlled network conditions, could permit unauthorized changes.

nvdaltovulnerabilidad CVSS 8.3 NVD