Alertas de Seguridad de la Información

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-8025] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This issue affects CBS Platform: through 09062026.  NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49948] Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability …

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and emb…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24064] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24065] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and th…

nvdaltovulnerabilidad CVSS 8.1 NVD

I Crítico vulnerabilidad

09/06/2026

[CVE-2026-10523] An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R1…

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-10727] An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions…

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

nvdaltovulnerabilidad CVSS 7.2 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-52906] In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being…

In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, so when the user mounts with "access=us…

nvdaltovulnerabilidad CVSS 7.7 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-52907] In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off…

In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons from > vs >= to avoid accessing one element beyond the end of the arrays. While at it, use ARRAY_SIZE instead of the _MAX enum values. [fix cosmetic issues]

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-7486] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This issue affects E-İmar: from 2.10.1.0 before 3.0.2.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

09/06/2026

[CVE-2026-46325] In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conver…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46326] In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix…

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer struct initialisation Make sure that the spi_transfer struct is zeroed out before use.

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46327] In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_su…

In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it. Move the call to dm_suspended_md after dm_get_live_table, so that the device can't…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46328] In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix …

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46330] In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP …

In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-pla…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46332] In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound b…

In the Linux kernel, the following vulnerability has been resolved: greybus: gb-beagleplay: bound bootloader receive buffering cc1352_bootloader_rx() appends each serdev chunk into the fixed rx_buffer before parsing bootloader packets. The helper can keep leftover bytes between callbacks and may receive multiple packets in one callback, so a single count value is not constrained by one packet le…

nvdaltovulnerabilidad CVSS 8.0 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46317] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmu…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unmap()), which can run at any time. kvm_vcpu_init_nested() reallocates the array and frees the old buffer while holding only kvm->arch.config_…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46319] In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release…

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: Only release RCU read lock after ct_ft When looking up a flow table in act_ct in tcf_ct_flow_table_get(), rhashtable_lookup_fast() internally opens and closes an RCU read critical section before returning ct_ft. The tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero() is invoked on the …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46320] In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths i…

In the Linux kernel, the following vulnerability has been resolved: tap: free page on error paths in tap_get_user_xdp() tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL, and returns -ENOMEM when build_skb() fails. Both paths jump to the err label without freeing the page that vhost_net_build_xdp() allocated for the frame. tap_sendmsg() discards the per-buffer return value an…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46321] In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame r…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on short-frame rejection in tun_xdp_one() tun_xdp_one() returns -EINVAL on a frame shorter than ETH_HLEN without freeing the page that vhost_net_build_xdp() allocated for it. tun_sendmsg() discards that -EINVAL and still returns total_len, so vhost_tx_batch() takes the success path and never frees the page; each s…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46322] In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb fai…

In the Linux kernel, the following vulnerability has been resolved: tun: free page on build_skb failure in tun_xdp_one() When build_skb() fails in tun_xdp_one(), the function sets ret to -ENOMEM and jumps to the out label, which returns without freeing the page that vhost_net_build_xdp() allocated for the frame. As with the short-frame rejection path, tun_sendmsg() discards the per-buffer error …

nvdaltovulnerabilidad CVSS 7.1 NVD