Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 8 horas

[CVE-2026-107814] MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1…

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an a…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107612] Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local…

Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to read or overwrite the inter-process communication handles used between the TightVNC service and its desktop server process. The named shared memory segment in the Global\ namespace that carries the pipe HANDLE values is created with a NULL DACL, and its name is derived from a …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-86361] Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Criti…

Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-102282] adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1,…

adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, adm-zip applies the Unix permission bits stored in a zip entry directly to the extracted file via `fs.chmodSync()` when `keepOriginalPermission=true` is passed to `extractAllTo()`/`extractEntryTo()` — and it never filters the setuid/setgid/sticky bits out of those bits. A zip crafted by an attacker…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-94204] The central cloud storage backend for the entire dashcam platform is misconfigured with public-read …

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-84414] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-73598] Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrec…

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-82164] Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment …

Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

Vulnerabilidad alta en Tauri: escalación de permisos mediante plugin de diálogo de archivos

Aplicaciones desarrolladas con Tauri que utilizan el plugin de diálogo para seleccionar archivos o carpetas son vulnerables a escalación de permisos mediante ataques XSS. Un atacante con capacidad de ejecución de JavaScript puede forzar acceso recursivo a árboles de directorios completos con permisos de lectura/escritura tras un único clic del usuario en un diálogo normal, sin notificación visible ni posibilidad de revocación. Esta vulnerabilidad afecta principalmente a aplicaciones de escritorio distribuidas en LATAM que gestionan datos sensibles de usuarios.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-91800] A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due…

A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-91798] A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader du…

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-49811] Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment …

Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad alta en Synology DiskStation Manager permite lectura/escritura de archivos arbitrarios

Una asignación incorrecta de permisos en la API LDAP de Synology DiskStation Manager (DSM) permite a usuarios autenticados remotamente leer, escribir archivos arbitrarios y ejecutar ataques de negación de servicio. Afecta versiones anteriores a 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 y 7.4-90075. En LATAM, es alta para empresas que usan NAS Synology como almacenamiento centralizado de datos sensibles o backups corporativos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85887] Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker …

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-45726] Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1…

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceServi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92941] vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a…

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-co…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54447] garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages act…

garminconnect is a Python 3 API wrapper for Garmin Connect that retrieves statistics and manages activities. Prior to 0.3.5, garminconnect/client.py Client.dump creates the OAuth token directory and garmin_tokens.json without explicit owner-only modes, so a permissive umask such as 022 can leave the directory mode at 0755 and the token file mode at 0644. garmin_tokens.json contains di_refresh_toke…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2024-58383] Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf…

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via the XML configuration templates in lib/configfiles/, even though the file contains the Froxlor SQL user's password. On systems where the parent directories are world readable (the default on Debian 12), any unprivileged local user able to execute commands or code on the host — in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-19583] Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the…

Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring artifacts. Additionally there was no requirement that client monitoring artifacts carry the CLIENT_EVENTS …

nvdcriticovulnerabilidad CVSS 9.9 NVD