Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58600] Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to el…

Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-56172] Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges lo…

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-56177] Use after free in Windows Server allows an authorized attacker to elevate privileges locally.

Use after free in Windows Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-56198] Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privilege…

Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-57098] Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attack…

Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-55007] Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a netw…

Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-50349] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-47297] Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over…

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84387] A improper neutralization of special elements used in a command ('command injection') vulnerability …

A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-84393] A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 thro…

A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82071] Insufficient validation of storage engine configuration options in MongoDB Server allows an authenti…

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary c…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82075] An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sha…

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources without any rate limiting, degrading or denying service to legitimate clients. No authentication, elevate…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-82533] DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local H…

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin. Attackers can exploit this flaw to invoke privileged commands such as commands/e…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82064] A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of servi…

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific type of replica set member. The server contains an assertion in its read concern processing logic that can be reached without authentication, and the assertion's assumptions about internal state do not hold for all member configurations, causing the server process to terminate.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82067] Improper handling of case sensitivity in the configuration validation component of MongoDB Server ma…

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authorization subsystem to remain in a default disabled state during server startup. An unauthenticated user with network access to a deployment where this condition occurs can perform arbitrary administrative operations, resulting in full impact of data confidentiality, integrity, and a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82061] A use-after-free security issue exists in the server's query execution memory tracking subsystem. An…

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user with read privileges can trigger a write to freed heap memory through a sequence of standard database commands, leading to server process crash or potential memory corruption. No user interaction is required.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-82053] A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections ca…

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control con…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-79569] Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter…

Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-75156] Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of A…

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's **multi-tenant** JWKS endpoint, an `id_token` minted in *any* Azure tenant — including one the attac…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-47625] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse miss…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD