Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/07/2026

[CVE-2026-7162] Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve sys…

Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to the affected software.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-9492] The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYT…

The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15515] A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects …

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclo…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15517] A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/…

A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the argument httpOID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15514] A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affec…

A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipulation of the argument phprpc_args can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be use…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

12/07/2026

[CVE-2026-15511] A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerabilit…

A vulnerability was determined in Comfast CF-WR631AX V3 up to 2.7.0.8. Affected by this vulnerability is the function system_wl_upload_pic_file of the file /usr/bin/webmgnt of the component FastCGI Backend. This manipulation of the argument filename causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15506] A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected elemen…

A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown function in the library saappctl.sys of the component Driver. Such manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. Upgrading to version 10.10.0 is sufficient to fix this issue. You shou…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-61875] luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN c…

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-61876] LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allo…

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56308] Capgo before 12.128.2 allows email address changes without requiring current password re-authenticat…

Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56313] Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prel…

Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password identities of users in foreign organizations. Attackers with org.update_settings permission and an active SSO provider can call the prelink-users endpoint to permanently remove email-based authentication for any user matching the …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-59260] OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticat…

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15498] A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa…

A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no vers…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56238] Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST glo…

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint that allows unauthenticated attackers to read sensitive financial and operational metrics using only the public apikey. Remote attackers can query the /rest/v1/global_stats endpoint to expose MRR, total revenue, plan-tier revenue breakdown, customer counts, and operational telemet…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56241] Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users …

Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundl…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15497] A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown fun…

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org/cloud/sonic/controller/controller/ExchangeController.java of the component JWT Authentication Filter. This manipulation causes code injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15491] A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a…

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15490] A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce…

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product impleme…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15488] A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileCon…

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15489] A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a…

A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release…

nvdaltovulnerabilidad CVSS 7.3 NVD