Alertas de Seguridad de la Información

I Alto vulnerabilidad

10/06/2026

[CVE-2025-71329] image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to …

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2025-71330] image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to …

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-24066] Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.p…

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by checking only the subject.OU value of the client's signing certificate and does not verify that the certificate chains to a trusted code-signing autho…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-24067] Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.p…

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subje…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2025-6254] The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, …

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Medio vulnerabilidad

10/06/2026

CVE-2026-0269 PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0269 PAN-OS: Denial of Service (DoS) in Tunnel Traffic Processing (Severity: MEDIUM). Tipo: Denegación de Servicio (DoS). Producto afectado: PAN-OS.

firewallngfwpan-os PAN PSIRT

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3326] The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before usi…

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-8071] The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize …

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24719] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24716] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66281] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-22893] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66273] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66279] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66280] An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating s…

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and …

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-62850] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 an…

nvdaltovulnerabilidad CVSS 7.2 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45541] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53674] BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention reso…

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP que…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46541] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46545] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes). This issue has been patched in version 1.5.0.

nvdaltovulnerabilidad CVSS 7.5 NVD