Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78182] A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environmen…

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. The manipulation of the argument order/sort leads to sql injection. Remote exploitation of the attack is possible. The exploit has bee…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78212] 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. U…

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78213] Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authen…

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78180] A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the fun…

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78181] A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#se…

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component Keypath Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem ea…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-19200] The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other is…

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions.  The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78178] A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/j…

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned".

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78171] A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vuln…

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78170] A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the…

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78208] exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() fun…

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78209] exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs i…

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78161] A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor o…

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78203] Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, …

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78206] exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory witho…

exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78157] A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file …

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78154] A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function…

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the pro…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78156] A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function …

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attack may be performed from remote. The name of the patch is a9c82ee0b590d76a581b058…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-78147] A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function dese…

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), wh…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-78143] A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. A…

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-78141] A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of th…

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCommand. The manipulation of the argument cmdinput leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.4 NVD