Alertas de Seguridad de la Información

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45685] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads …

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45686] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45678] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-45553] NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reSt…

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42654] Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System fo…

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40619] A high security vulnerability affecting Security Center main server installations has been identifie…

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40780] Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP Boo…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

02/06/2026

[CVE-2026-30649] Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute a…

Buffer Overflow vulnerability in VIVOTEK INC FD8136-VVTK-0300a allows a remote attacker to execute arbitrary code via the set_getparam.cgi component

nvdaltovulnerabilidad CVSS 7.3 NVD

V Alto vulnerabilidad

02/06/2026

[CVE-2026-30650] A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cg…

A post-authentication remote buffer overflow vulnerability exists in the /cgi-bin/admin/eventtask.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device remotely.

nvdaltovulnerabilidad CVSS 8.8 NVD

V Alto vulnerabilidad

02/06/2026

[CVE-2026-30652] A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin i…

A remote buffer overflow vulnerability exists in the /cgi-bin/dido/setdo.cgi endpoint of the admin interface of Vivotek FD8136 cameras running firmware version FD8136-VVTK-0300a. This flaw allows an authenticated attacker to execute arbitrary code as root on the device.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

02/06/2026

[CVE-2026-10591] Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.…

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10629] SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec inte…

SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.

nvdaltovulnerabilidad CVSS 7.4 NVD

B Alto vulnerabilidad

02/06/2026

[CVE-2026-10046] Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS I…

Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the BIOS INT 0x15 / E820 memory map handler, implemented in napoca/guests/bios_handlers.c. The handler computes a destination offset into the guest RealModeMemory buffer from guest-controlled ES and EDI register values without validating that the resulting address remains within the 1MB RealModeMemory allocat…

nvdaltovulnerabilidad CVSS 7.8 NVD

B Alto vulnerabilidad

02/06/2026

[CVE-2026-10047] The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the re…

The Bitdefender Napoca bare-metal hypervisor contains an out-of-bounds write vulnerability in the real-mode hook handler, implemented in napoca/kernel/handler.c. The handler uses a guest-controlled SS:SP-derived offset as an index into the 1MB RealModeMemory buffer without bounds validation. With SS=0xFFFF and ESP=0xFFFF, the computed offset can reach 0x10FFEF, exceeding the RealModeMemory buffer …

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7195] CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4…

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user intera…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7201] CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.…

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privile…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7313] CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.…

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39552] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39553] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39555] Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. Thi…

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.

nvdaltovulnerabilidad CVSS 8.1 NVD