Alertas de Seguridad de la Información

? Crítico alerta

11/08/2026

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Three Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-20349, CVE-2026-68820, CVE-2026-72898.

cisaus-certalerta CISA KEV

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-19425] Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability…

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19424] Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability.…

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Medio vulnerabilidad

11/08/2026

CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access

Microsoft publica advisory de seguridad: CVE-2026-68146 ftrace: Add global mutex to serialize trace_parser access.

Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup

Microsoft publica advisory de seguridad: CVE-2026-68181 mei: bus: access mei_device under device_lock on cleanup.

Microsoft MSRC

M Medio vulnerabilidad

11/08/2026

CVE-2026-68388 smb/client: handle overlapping allocated ranges in fallocate

Microsoft publica advisory de seguridad: CVE-2026-68388 smb/client: handle overlapping allocated ranges in fallocate.

Microsoft MSRC

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66763] SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated w…

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful exploitation could allow the attacker to obtain sensitive authentication data and modify protected inform…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58243] SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality…

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44764] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44765] Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence…

Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-58230] SAP Approuter does not sufficiently validate certain token content under specific configurations. An…

SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-34265] SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors i…

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-44758] SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to subm…

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-44763] SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient …

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the i…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-8718] tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles g…

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72914] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14,…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72915] Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until …

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collectio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-73030] unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_w…

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72910] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/pu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72911] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inje…

nvdcriticovulnerabilidad CVSS 9.9 NVD