Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/08/2026

Vulnerabilidad de escalada de privilegios en ToolJet anterior a v3.16.208

ToolJet versiones anteriores a la 3.16.208 contiene una falla alta de validación de pertenencia organizacional en rutas de lectura de bases de datos. Un usuario autenticado puede acceder a esquemas de tablas y datos de otras organizaciones proporcionando IDs arbitrarios en parámetros URL, comprometiendo la confidencialidad de datos multiinquilino. Esta vulnerabilidad afecta directamente a empresas en LATAM que utilizan ToolJet para gestionar datos sensibles de múltiples clientes o departamentos.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

Vulnerabilidad de escalada de privilegios en ToolJet Database anterior a v3.16.44

ToolJet Database versiones anteriores a v3.16.44 contienen una vulnerabilidad de escalada de privilegios en el endpoint join_tables que otorga capacidades JOIN_TABLES a todos los usuarios autenticados sin validar rol o pertenencia al workspace. Atacantes pueden leer tablas arbitrarias de cualquier workspace en ToolJet Database suministrando identificadores de workspace víctima en la ruta de solicitud mientras se autentican con su propio workspace.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82668] A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerab…

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0-beta addr…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81624] Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how …

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82630] A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager…

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82628] A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function …

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82621] A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4c…

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82615] A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affec…

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Customer::find_phone of the file /passwordrecover.php of the component Password Recovery Interface. The manipulation of the argument phonenumber leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82614] A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affect…

A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadResultList of the file /index.php?q=product of the component Product Category Filter Interface. Executing a manipulation of the argument Category can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82611] A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this…

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function Customer::cusAuthentication of the file /login.php of the component Customer Login Interface. This manipulation of the argument U_USERNAME causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used fo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82612] A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affe…

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue is the function loadResultList of the file /index.php?q=single-item of the component Product Detail Page. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82613] A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the f…

A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82610] A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is…

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employee::employeeAuthentication of the file /rider/login.php of the component Login Interface. The manipulation of the argument emp_email results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82607] A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impact…

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb_ajax_simple_avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82608] A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes o…

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82600] A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown fun…

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82597] A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function …

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82598] A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file se…

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82595] A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function s…

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

30/08/2026

[CVE-2026-82549] A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of …

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component SecurityModeComplete Handler. Such manipulation leads to improper validation of integrity check value. The attack may be launched remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.3 NVD