Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54094] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50549] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-23879] py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encr…

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic…

nvdaltovulnerabilidad CVSS 8.0 NVD

P Alto vulnerabilidad

24/06/2026

[CVE-2026-35025] ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows aut…

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directo…

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

22/06/2026

[CVE-2026-44274] Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Be…

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-50656] Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Micros…

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

13/06/2026

[CVE-2026-54230] A symlink following vulnerability was found in the ABRT post-create event handler scripts in librepo…

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

nvdaltovulnerabilidad CVSS 7.0 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54056] Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow …

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a stag…

nvdaltovulnerabilidad CVSS 7.6 NVD

K Crítico vulnerabilidad

10/06/2026

[CVE-2026-53476] A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local…

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-11837] A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The…

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator ru…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-50511] Improper link resolution before file access ('link following') in Microsoft PC Manager allows an aut…

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45586] Improper link resolution before file access ('link following') in Windows Collaborative Translation …

Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-42989] Improper link resolution before file access ('link following') in Winlogon allows an authorized atta…

Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41236] Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following fl…

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned SSH key synchronization path used for customer FTP users. The provisioning code appends public keys to `~/.ssh/authorized_keys` under a customer-controlled home directory without verifying that the target path is not a symbolic link. If an attacker controls a shell-enabled custo…

nvdaltovulnerabilidad CVSS 8.8 NVD