Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19908] PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows networ…

PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19909] PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnera…

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19910] PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnera…

PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the application installer. The issue results from the lack of proper …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-17184] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due t…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-17186] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL command…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16708] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-73678] MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution …

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73679] ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module th…

ImpressCMS contains an authenticated remote code execution vulnerability in the custom tag module that allows authenticated administrators to execute arbitrary PHP code by storing a malicious payload in a custom tag with PHP type enabled. The application decodes HTML-encoded content via undoHtmlSpecialChars() before passing it to eval() in the renderWithPhp() method, bypassing HTML Purifier saniti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-45699] Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.…

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19188] A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gate…

A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands w…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-72970] Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exe…

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-73849] Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=r…

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19847] A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19679] An input validation vulnerability exists in Security Center's file upload handling, where insufficie…

An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19680] A SQL injection vulnerability exists in Security Center that could allow an attacker to access unaut…

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19681] An authenticated command injection vulnerability exists in Security Center related to file upload pr…

An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19682] A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker…

A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19846] A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function s…

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19629] A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Secu…

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19635] A local privilege escalation vulnerability exists in Security Center. An attacker with write access …

A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction.

nvdaltovulnerabilidad CVSS 8.8 NVD