Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19847] A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19679] An input validation vulnerability exists in Security Center's file upload handling, where insufficie…

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19846] A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function s…

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-12366] Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an …

Zephyr's dynamic kernel-object disposal path unref_check() in kernel/userspace/userspace.c frees an object's storage (k_free(dyn->data)) once its reference count reaches zero, after running a per-object-type cleanup. The cleanup switch handled only K_OBJ_MSGQ and K_OBJ_STACK; there was no K_OBJ_TIMER case. A dynamically-allocated, initialized, and armed k_timer keeps its embedded struct _timeout d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-46603] VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing …

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-46439] compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 a…

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19844] A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the func…

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19845] A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function s…

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19628] A command injection vulnerability exists in Tenable Security Center. An authenticated administrator …

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19626] A remote code execution vulnerability exists in Tenable Security Center's report generation function…

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16772] In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to …

In Akaunting versions sync()` call without verifying whether the caller is authorized to manage roles. …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19768] Improper control of generation of code ('Code Injection') in the settings feature in Devolutions Pow…

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19825] A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. Th…

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19826] A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian…

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any fu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19823] A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the f…

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19824] A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element i…

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad alta en File Browser permite acceso no autorizado a archivos de otros usuarios

File Browser versiones anteriores a 2.63.20 contiene una falla de aislamiento en los mecanismos de autenticación por proxy y auto-aprovisionamiento de usuarios. Atacantes con credenciales válidas pueden leer, modificar, eliminar y compartir archivos de otros usuarios al explotar la asignación del scope raíz del servidor. Esta vulnerabilidad afecta especialmente a organizaciones en LATAM que despliegan File Browser en entornos multi-usuario o en arquitecturas de proxy.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

Regresión de autorización en Budibase 3.39.4-3.40.0 expone URLs firmadas de Amazon S3

Budibase versiones 3.39.4 anteriores a 3.40.0 contienen un fallo de control de acceso en el endpoint de carga de adjuntos S3. Usuarios con permisos BASIC pueden obtener URLs presignadas PutObject de buckets S3 arbitrarios, permitiendo escritura no autorizada en almacenamiento en la nube. Afecta directamente a empresas en LATAM que usan Budibase para gestión de contenidos y datos empresariales.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad de escalada de privilegios en Grav Plugin API anterior a 1.0.13

El plugin API de Grav (getgrav/grav-plugin-api) versiones anteriores a 1.0.13 no valida correctamente los permisos de scope en claves API, permitiendo que una API key con privilegios limitados (api.users.write) pueda crear invitaciones con flags de acceso de super-administrador. Esta vulnerabilidad afecta a sitios web en CMS Grav que exponen APIs para gestión de usuarios, siendo alta en infraestructuras compartidas y multi-tenant comunes en hosting LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

14/08/2026

Plugin API de Grav vulnerable a bypass de permisos en versiones anteriores a 1.0.13

El plugin API de Grav (getgrav/grav-plugin-api) anterior a la versión 1.0.13 contiene un bypass crítico en los métodos create() y update() del controlador UsersController. Una clave API con permisos limitados (api.users.write) puede escalarse a privilegios de administrador sin que se validen adecuadamente los alcances de seguridad. Esto afecta sistemas de gestión de contenidos en empresas y organizaciones de LATAM que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD