Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/08/2026

[CVE-2026-13121] Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulne…

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels RAS Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the RAS…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76998] A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0.…

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=delete_category. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-77004] A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi…

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?method=SET&section=ptest_sn. Executing a manipulation of the argument sn can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-75140] jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnera…

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-namespaced elements. The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers ca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76996] A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impact…

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/view_order.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-61898] The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accounts…

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-49825] lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attribute…

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16927] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges d…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16928] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16932] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary comm…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16922] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16923] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileg…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper privilege management.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16924] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-16925] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege esca…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-16926] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary f…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76833] @cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to…

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environm…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76990] A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue …

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76633] WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that a…

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routin…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76635] baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows au…

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-76987] A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. …

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory corruption. It is possible to initiate the attack remotely. The exploit has been released to the publi…

nvdaltovulnerabilidad CVSS 7.3 NVD