Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-70460] rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to e…

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-63426] During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Mana…

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53803] rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwri…

rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53795] rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write fil…

rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessib…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53793] rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to es…

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ bo…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53784] rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access file…

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to ref…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53785] rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write f…

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the d…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-53783] rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in …

rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-15994] During an internal security assessment, an improper link following vulnerability was identified in L…

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-12036] An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and…

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en filebrowser anterior a 2.63.19 permite eliminación de archivos fuera de alcance

filebrowser versiones anteriores a 2.63.19 contienen una vulnerabilidad de eliminación de archivos fuera del alcance en el mecanismo de evicción de caché TUS. Usuarios autenticados con solo permisos de Crear pueden eliminar archivos arbitrarios mediante manipulación de directorios con enlaces simbólicos durante la ventana TTL del caché. Esta vulnerabilidad afecta servidores de gestión de contenidos y repositorios de archivos en empresas que usan filebrowser con control de acceso basado en permisos.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62832] Improper link resolution before file access ('link following') in Windows User Profile Service allow…

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62812] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62803] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62807] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62776] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-62761] Improper link resolution before file access ('link following') in Windows DHCP Server allows an auth…

Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-61358] Improper link resolution before file access ('link following') in Windows Accessibility Infrastructu…

Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72694] A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops priv…

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. Thi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-63622] A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm…

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for …

nvdaltovulnerabilidad CVSS 7.8 NVD