Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-58491] Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpg…

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POST /@warpgate/api/sso/return handler inserts without HTML escaping into the response generated by warpgate-protocol-http/src/api/sso_provider_list.rs. A victim who follows a crafted link and completes …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/09/2026

[CVE-2026-79920] Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user …

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

21/09/2026

Vulnerabilidad alta en CRI-O permite eludir contexto de seguridad en Kubernetes

Una falla en la restauración de puntos de control de CRI-O permite a usuarios con capacidad de crear pods eludir el contexto de seguridad de Kubernetes, reteniendo credenciales, capacidades Linux y configuraciones seccomp del contenedor comprometido. Esto expone infraestructuras containerizadas en México y LATAM a ejecución con privilegios elevados, afectando principalmente plataformas que utilizan Kubernetes en producción con múltiples usuarios o entornos multi-tenant.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87886] Local privilege escalation due to insecure file permissions. The following products are affected: Ac…

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-19477] There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for …

There is stack-based buffer overflow vulnerability recently discovered in MCC Universal Library for Linux (uldaq).  This may result in information disclosure or arbitrary code execution. This vulnerability affects MCC Universal Library for Linux (uldaq) v1.2.1 and prior versions.

nvdaltovulnerabilidad CVSS 7.8 NVD

C Informativo vulnerabilidad

17/09/2026

[CVE-2026-92502] In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags o…

In the Linux kernel, the following vulnerability has been resolved: ext4: clear stale xarray tags on folios skipped during writeback In data=journal mode, the writeback thread can hit the WARN_ON_ONCE(sb_rdonly(sb)) in ext4_journal_check_start() while the superblock is being remounted read-only during reboot: Workqueue: writeback wb_workfn (flush-253:0) RIP: 0010:ext4_journal_check_start+0x8b/0…

check-pointcheckpointbajo CVSS 0.0 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90048] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bound…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() ni_create_attr_list() allocates a fixed buffer of al_aligned(record_size) (== record_size) bytes and then walks every attribute of the primary MFT record, writing one ATTR_LIST_ENTRY per attribute and advancing the cursor by le_size(name_len), with no check against …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90049] In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error…

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() skb_zerocopy() copies frags from @from into @to. On an skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive operation on the source skb the copy helper does not own. That completes @from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including t…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90038] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during export state revocation nfsd4_revoke_export_states() has the same use-after-free as nfsd4_revoke_states(): it drops nn->client_lock across revoke_one_stid() and the following read of clp->cl_minorversion, but the stateid reference it holds does not pin the client. A teardown racing the…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90041] In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list…

In the Linux kernel, the following vulnerability has been resolved: HID: sony: clean up device list on probe failure sony_input_configured() adds some controllers to sony_device_list before HID core registers their input devices. input_register_device() can fail after the callback returns successfully. sony_probe() then observes that HID_CLAIMED_INPUT is clear and unwinds, but only stops the HID…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90042] In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filename…

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the vmalloc() regi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90043] In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit positio…

In the Linux kernel, the following vulnerability has been resolved: zram: fix slot lock bit position on big-endian 64-bit The slot lock is a bit operation on the whole __lock word, which flags and ac_time alias as two u32s. On little-endian the lock bit lands in the position ZRAM_ENTRY_LOCK reserves in flags, so the aliasing works out. On 64-bit big-endian it lands in ac_time instead: with ZRA…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90044] In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-Afte…

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix Use-After-Free in AIO error path In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io() fails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is freed. However, for AIO operations, the kiocb cancel function was already armed and kiocb->private was set to `p`. If a c…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90045] In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifeti…

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90046] In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't spin_trylo…

In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't spin_trylock() in NMI on UP Patch series "mm/page_alloc: fixes for free_pages_nolock() on RT/UP". Pre-existing bugs found by Sashiko during review of this other series: https://lore.kernel.org/all/20260703-alloc-trylock-v5-0-c87b714e19d3@google.com/ I have not reproduced these bugs, and I suspect there is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90047] In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat…

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't hand out the flat CCS storage as usable VRAM get_flat_ccs_offset() reads the base of the flat CCS storage from the hardware, scales it by the number of enabled L3 nodes, and rounds the result up to 128K. Everything below that offset is then handed to the VRAM allocator as usable memory. Rounding a limit that mean…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90030] In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when i…

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90032] In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive…

In the Linux kernel, the following vulnerability has been resolved: media: usbtv: keep device alive while ALSA card exists The ALSA PCM callbacks store the driver state in pcm->private_data. An open PCM file can outlive USB disconnect because usbtv_audio_free() uses snd_card_free_when_closed(). The disconnect path can then drop the V4L2 device reference and free struct usbtv before ALSA releases…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90036] In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-…

In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client use-after-free during blocked-lock reaping A bare lock owner -- its only remaining reference a blocked lock on nn->blocked_locks_lru -- holds a raw pointer to its nfs4_client but no reference keeping the client alive. When the per-net laundromat reaps such a lock, freeing the nbl drops the owner reference he…

nvdcriticovulnerabilidad CVSS 9.8 NVD