Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73680] Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration th…

Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sani…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19908] PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows networ…

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19909] PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnera…

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19910] PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnera…

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the application installer. The issue results from the lack of proper …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-18554] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17081] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17175] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17177] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service du…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to cause a denial of service due to uncontrolled recursion.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17179] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16708] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16879] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass securit…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16915] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73679] ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module th…

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier saniti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-45699] Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.…

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-72970] Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exe…

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19847] A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19679] An input validation vulnerability exists in Security Center's file upload handling, where insufficie…

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19680] A SQL injection vulnerability exists in Security Center that could allow an attacker to access unaut…

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19846] A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function s…

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-12366] Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an …

Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no K_OBJ_TIMER case. A dynamically-allocated, initialized, and armed k_timer keeps its embedded struct _timeout d…

nvdaltovulnerabilidad CVSS 8.8 NVD