Alertas de Seguridad de la Información

G Medio vulnerabilidad

14/08/2026

Chromium: CVE-2026-19558 Use after free in Extensions

Microsoft publica advisory de seguridad: Chromium: CVE-2026-19558 Use after free in Extensions.

Microsoft MSRC

M Alto vulnerabilidad

14/08/2026

[CVE-2026-46603] VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing …

VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unused Huffman tree groups. This allows a remote attacker to cause a denial of service via memory exhaustion.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-46439] compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 a…

compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection (SSTI) vulnerability exists in the `trestle author jinja` command. The command recursively evaluates rendered templates, allowing an attacker to achieve arbitrary command execution with privileges of the running process by injecting malicious payloads i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19844] A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the func…

A vulnerability was found in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component ipv6.so. Performing a manipulation of the argument radvdinterfacename results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19845] A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function s…

A vulnerability was determined in TOTOLINK A800R 4.1.2cu.5137_B20200730. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. Executing a manipulation of the argument Comment can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19628] A command injection vulnerability exists in Tenable Security Center. An authenticated administrator …

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-19626] A remote code execution vulnerability exists in Tenable Security Center's report generation function…

A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66271] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-63700] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permissio…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Incorrect Default Permission vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-66270] Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File…

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-53970] ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby…

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can intercept or replace downloads for secondary resource and patch paths in shim.rb, injecting attacker-co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-69101] Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authen…

Datavane TIS v5.0.0 contains an XML external entity (XXE) injection vulnerability that allows authenticated attackers to perform server-side request forgery and out-of-band file exfiltration by supplying a crafted taskScript payload to the doEditWorkflow endpoint, which processes XML through an unhardened DocumentBuilderFactory with external entities and DTD loading enabled. Attackers can send a m…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73633] Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an applica…

Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions from a JSON request body, the plugin reads that body into memory without bounding how much it will accept, so a single request can exhaust the heap and deny service to other users. The plugin's configurable JSON input length limit does not bound this read. The …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19768] Improper control of generation of code ('Code Injection') in the settings feature in Devolutions Pow…

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-73673] Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability tha…

Netis NC63 router firmware V3.0.0.3327 contains an unauthenticated firmware update vulnerability that allows unauthenticated attackers to submit unsigned firmware images by exploiting a missing authentication enforcement flaw in the Boa web server and netis.cgi CGI dispatcher. Attackers can send a multipart POST request to /cgi-bin/upload_fw.cgi without a valid session cookie, bypassing authentica…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19825] A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. Th…

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19826] A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian…

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The exploit is now public and may be used. The project closed the issue report as "not planned" without any fu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19823] A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the f…

A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19824] A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element i…

A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad alta en File Browser permite acceso no autorizado a archivos de otros usuarios

File Browser versiones anteriores a 2.63.20 contiene una falla de aislamiento en los mecanismos de autenticación por proxy y auto-aprovisionamiento de usuarios. Atacantes con credenciales válidas pueden leer, modificar, eliminar y compartir archivos de otros usuarios al explotar la asignación del scope raíz del servidor. Esta vulnerabilidad afecta especialmente a organizaciones en LATAM que despliegan File Browser en entornos multi-usuario o en arquitecturas de proxy.

nvdaltovulnerabilidad CVSS 8.8 NVD