Alertas de Seguridad de la Información

M Crítico vulnerabilidad

08/09/2026

CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Crítico vulnerabilidad

08/09/2026

CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).

windowsrce Microsoft MSRC

M Medio vulnerabilidad

08/09/2026

CVE-2026-78515 Microsoft Office Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-78515 Microsoft Office Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

officeinfo-disclosure Microsoft MSRC

M Medio vulnerabilidad

08/09/2026

CVE-2026-68891 Microsoft Standard XPS Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-68891 Microsoft Standard XPS Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC

? Crítico alerta

08/09/2026

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Four Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2026-75650, CVE-2026-81963, CVE-2026-85880, CVE-2026-86218.

cisaus-certalerta CISA KEV

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-86510] A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params …

A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76967] SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally…

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This res…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-76969] @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multit…

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-86509] A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of t…

A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-66768] SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked fro…

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and avai…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-58240] SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application…

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confide…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-44756] A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Und…

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availabil…

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Medio vulnerabilidad

08/09/2026

Arbitrary process termination from exposed minifilter communication port

Fortinet PSIRT publica advisory de seguridad: Arbitrary process termination from exposed minifilter communication port. Tipo: Vulnerabilidad de seguridad. Producto afectado: Forticlient.

firewallforticlient PAN PSIRT

F Medio vulnerabilidad

08/09/2026

Cron Job Injection in Remote Backup

Fortinet PSIRT publica advisory de seguridad: Cron Job Injection in Remote Backup. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortisandbox.

firewallfortisandbox PAN PSIRT

F Crítico vulnerabilidad

08/09/2026

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

Fortinet PSIRT publica advisory de seguridad: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortisandbox.

firewallfortisandbox PAN PSIRT

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86544] knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti…

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86540] knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project co…

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86437] Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with o…

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which exec…

nvdaltovulnerabilidad CVSS 7.2 NVD