Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62807] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62776] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62761] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-61358] Improper link resolution before file access ('link following') in Windows Accessibility Infrastructu…

Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72694] A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops priv…

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. Thi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-63622] A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm…

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-71556] go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alp…

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-12410] Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows …

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-13268] G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This v…

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Backup Service. By…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-50163] oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u…

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "/payload.tar.gz/evil_cwd_link") to resolve header.Linkname against the process current working directory for a Typeflag=TypeLink entry such as N…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61371] Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, …

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-54572] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, with -l/--links, rclone serializes symlinks as .rclonelink text objects and recreates them on a local destination without validating the target, allowing an attacker-controlled remote to plant an escaping symlink and cause a following object write to land outside the desti…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50526] Improper link resolution before file access ('link following') in .NET allows an authorized attacker…

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50469] Improper link resolution before file access ('link following') in Windows Projected File System allo…

Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50438] Improper link resolution before file access ('link following') in Microsoft PC Manager allows an aut…

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58636] Improper link resolution before file access ('link following') in Window PC Manager allows an author…

Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50364] Improper link resolution before file access ('link following') in Windows Server Backup allows an au…

Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49791] Improper link resolution before file access ('link following') in Windows Routing and Remote Access …

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49176] Improper privilege management in Windows WalletService allows an authorized attacker to elevate priv…

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15392] DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust…

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers c…

nvdaltovulnerabilidad CVSS 7.7 NVD