Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17229] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an in…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18164] An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentic…

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18846] IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client dat…

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17199] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbou…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to unbounded resource allocation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16982] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a hea…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17004] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an in…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16887] IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16815] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentia…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16868] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the u…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-13460] IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded toke…

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-13365] IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could al…

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73482] phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/a…

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logge…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17220] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73566] node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter …

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filt…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73643] js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML documen…

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the sam…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2024-58374] Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet en…

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2019-25765] ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthent…

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation e…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73266] A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenti…

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59109] SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in re…

SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Da…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73670] A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authentica…

A CMS contains a SQL injection vulnerability in admin/db_data.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the table_name GET or POST parameter. Attackers can perform table traversal, time-based blind, boolean-based blind, and error-based injection techniques to enumerate full database sch…

nvdaltovulnerabilidad CVSS 7.2 NVD