Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/09/2026

[CVE-2026-79153] Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in …

Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that allows an authenticated local user to gain elevated privileges to NT AUTHORITY\SYSTEM on affected systems.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-88421] Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0…

Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to view restricted blog entries via the blog index, the tag, category, author and date archives, the sidebar widgets, or the RSS feed.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-51773] An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker pr…

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-52622] An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES…

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2025-51457] D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within t…

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98154] In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup ord…

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the hos…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98156] In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for…

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM. virtio-gpu makes the…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98150] In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation f…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpf_map_check_op_flags() currently compares that ID with num_possible_cpus(), which is the number of possible CPUs rather than a bound on CPU IDs. On an arm64 QEMU guest with a CPU device-tree hol…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98143] In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U…

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Don't read the U65 rounding mode as a storage mode Bits 15:14 of NPU_SET_{IFM,OFM}_PRECISION select the activation storage mode on U85 only. On U65 the same field holds the rounding mode, and the command stream parser has read it as a storage mode since the driver was added. That went unnoticed while unknown valu…

nvdaltovulnerabilidad CVSS 7.8 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98132] In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead …

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO states.c:__clean_func_state() can downgrade scalar zero spill to STACK_ZERO in the following case: *(u64 *)(r10 - 8) = 0; ... checkpoint ... r1 = *(u32 *)(r10 - 4); ... no reads from r10-8 ... Here 4 bytes at r10-8 are dead and verifier changes scalar spil…

check-pointcheckpointbajo CVSS 0.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98130] In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP…

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking the association reference required for the newly armed timer. The timer callbac…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98122] In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free …

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every MDBE_ATTR_SRC_LIST member, accepts the all-zeros address. A source list is only accepted on a (*, G) entry, whose source is the all-zeros address, and for each member of the list an (S, G) entry i…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98112] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifeti…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix listener task lifetime on netdev events The listener thread exits when its listening socket is shutdown. The netdevice notifier shuts down the socket before calling kthread_stop(), so the task_struct can be freed before kthread_stop() gets its reference. Create the listener in a stopped state and hold an extra task_s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98115] In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions du…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks duri…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98116] In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap w…

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM stream lock, but the lock is released long before the buffer is actually freed: snd_pcm_sync_stop(), constraint refinement and do_free_pages()…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98108] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan l2cap_new_connection() sets default value of channel mode to match the parent channel. l2cap_le_connect_req() left this at the default, and created L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that mode. This causes FLAG_DEFER_SETUP channels to reply…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98096] In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network heade…

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the skb->data position by pushing sizeof(struct ipv6hdr), assuming the SRH immedia…

nvdaltovulnerabilidad CVSS 7.4 NVD

C Informativo vulnerabilidad

25/09/2026

[CVE-2026-98084] In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't cle…

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf…

check-pointcheckpointbajo CVSS 0.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98083] In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-afte…

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. btrfs_finish_one_ordered(), the production caller through btrfs_insert_raid_extent(), still owns the transaction handle. It handles …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98069] In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath l…

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rds_conn_shutdown() rds_conn_shutdown() quiesces the transmit and receive-refill paths by waiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and then runs the transport shutdown and rds_conn_path_reset(). Sampling the bits clear is not the same as owning them: the moment afte…

nvdaltovulnerabilidad CVSS 8.1 NVD