Alertas de Seguridad de la Información

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62896] Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over …

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62918] Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker …

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-63508] Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthori…

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62830] Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a …

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-62836] Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance al…

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-59115] '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to el…

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-59118] Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges…

Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-50515] Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code…

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-56161] Improper access control in Azure Logic Apps allows an authorized attacker to disclose information ov…

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-56162] Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges …

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-49163] Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insigh…

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-50481] Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacke…

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-7867] A flaw was found in udisks2. A local attacker with an active console session can exploit insufficien…

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-8325] A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write…

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-7406] A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted…

A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-71488] league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2…

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70635] TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability th…

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70636] Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated at…

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70638] llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android …

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70640] llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LL…

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijac…

nvdaltovulnerabilidad CVSS 7.0 NVD