Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50438] Improper link resolution before file access ('link following') in Microsoft PC Manager allows an aut…

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58636] Improper link resolution before file access ('link following') in Window PC Manager allows an author…

Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50364] Improper link resolution before file access ('link following') in Windows Server Backup allows an au…

Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49791] Improper link resolution before file access ('link following') in Windows Routing and Remote Access …

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49176] Improper privilege management in Windows WalletService allows an authorized attacker to elevate priv…

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15392] DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust…

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers c…

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62189] OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync featu…

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15684] Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerabilit…

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Disk Clean functionality.…

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-39246] decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing…

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-14891] HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver th…

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.…

nvdaltovulnerabilidad CVSS 8.7 NVD

K Crítico vulnerabilidad

06/07/2026

[CVE-2026-57571] Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler sa…

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; t…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57991] Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) al…

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-25718] Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowi…

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

nvdcriticovulnerabilidad CVSS 9.1 NVD

D Alto vulnerabilidad

01/07/2026

[CVE-2026-41121] Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Befo…

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-55607] Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling a…

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-54369] acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based fun…

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-54371] attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr ut…

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to lo…

nvdaltovulnerabilidad CVSS 7.1 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54352] Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packag…

Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appI…

nvdcriticovulnerabilidad CVSS 9.6 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-45405] Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract…

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — includin…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55667] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one …

nvdaltovulnerabilidad CVSS 8.2 NVD