Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69279] Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate pr…

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-68840] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-68824] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-56172] Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges lo…

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-50349] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82071] Insufficient validation of storage engine configuration options in MongoDB Server allows an authenti…

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary c…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82075] An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sha…

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevate…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82064] A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of servi…

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82067] Improper handling of case sensitivity in the configuration validation component of MongoDB Server ma…

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82053] A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections ca…

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control con…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-47625] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse miss…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-20293] A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UC…

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an unauthenticated attacker with physical access to an affected device to bypass UEFI Secure Boot validation checks and execute unauthorized softw…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-16497] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause exce…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86738] Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to …

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86733] Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/…

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86729] WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in …

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing agains…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86666] A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function …

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFile of the file controllers/pic.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not res…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86718] WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request fo…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.json.php and finishAll.json.php that allows unauthenticated attackers to mutate live history by making GET requests without CSRF token validation. Attackers can craft malicious pages that trigger administrator browsers to delete all live transmission history or m…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-16025] Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Mon…

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-16037] Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. P…

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.

nvdaltovulnerabilidad CVSS 7.5 NVD