Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-78626] The Okta Access Gateway improperly handles input sanitization and regular expression evaluation with…

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-78623] The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into datab…

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against the configured backend database.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-75993] ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could ex…

ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-75999] ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary …

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue requires user interaction in that a victim must ope…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-19232] Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result i…

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86716] A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_c…

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82536] Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing l…

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix followed by the stderr-redirecting pipe operator and a denied command, causing …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82537] Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execu…

Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-76200] Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused…

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-76201] Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused…

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86669] A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login …

A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86673] A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca5…

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This prod…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81822] The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files…

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81355] Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker …

Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-80093] Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate pr…

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-78519] Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute…

Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-77894] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76191] Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability th…

Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-72989] Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclos…

Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-72923] In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and …

In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyc…

nvdaltovulnerabilidad CVSS 7.5 NVD