Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-48561] Improper neutralization of special elements used in a command ('command injection') in Copilot Chat …

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-48564] Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over…

Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-42975] Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execu…

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-42982] Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized a…

Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-42990] Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code…

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-44800] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-40378] Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (L…

Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-40400] Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a n…

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-42900] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15701] A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is …

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument Host causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15703] A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulner…

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-62643] In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS)…

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843.

nvdaltovulnerabilidad CVSS 7.2 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59841] A improper restriction of communication channel to intended endpoints vulnerability in Fortinet Fort…

A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-60081] DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column …

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-60082] DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When t…

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could be triggered by a caller supplying inconsistent metadata and rows to the prepare method.

nvdcriticovulnerabilidad CVSS 9.1 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59204] Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumul…

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59205] Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, i…

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59835] A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, F…

A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.

nvdaltovulnerabilidad CVSS 8.6 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-59836] A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, Fort…

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59199] Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger…

Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD