Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).

exchangeeop Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68802 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68802 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68808 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68808 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68813 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68813 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-70318 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70318 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-70327 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70327 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-70328 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70328 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

G Crítico vulnerabilidad

11/08/2026

CVE-2026-70339 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70339 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

edgerce Microsoft MSRC

M Crítico vulnerabilidad

11/08/2026

CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

[CVE-2026-16053] Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to A…

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-4757] A VAPIX API parameter had improper input validation which could allow code execution and potentially…

A VAPIX API parameter had improper input validation which could allow code execution and potentially lead to a privilege escalation. This flaw can only be exploited after authenticating with an administrator-privileged service account.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-19516] A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound re…

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and r…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-13716] Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authent…

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

? Crítico alerta

11/08/2026

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Three Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-20349, CVE-2026-68820, CVE-2026-72898.

cisaus-certalerta CISA KEV

M Medio vulnerabilidad

11/08/2026

CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access

Microsoft publica advisory de seguridad: CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access.

Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66763] SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated w…

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected inform…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58243] SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality…

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44764] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44765] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58230] SAP Approuter does not sufficiently validate certain token content under specific configurations. An…

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality …

nvdaltovulnerabilidad CVSS 7.0 NVD