Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10694] A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this iss…

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

03/06/2026

[CVE-2026-9516] Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input …

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-35482] alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet…

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environme…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2022-4992] Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG…

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2024-14036] Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability …

Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-adjacent attackers to trigger high CPU load by sending specially crafted, unencrypted SDC messages during the discovery process. Attackers with access to the hospital network can send malformed SDC packets to exhaust CPU resources in the affected process, causing further SDC mess…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-49143] BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP h…

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Fun…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10619] A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93…

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10620] A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function…

A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.php. This manipulation of the argument eid/did causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

N Alto vulnerabilidad

02/06/2026

[CVE-2026-8035] Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause …

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

nvdaltovulnerabilidad CVSS 7.1 NVD

N Alto vulnerabilidad

02/06/2026

[CVE-2026-8036] Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system …

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

02/06/2026

[CVE-2026-5076] The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in a…

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. Th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

02/06/2026

[CVE-2026-42342] React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.…

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mo…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

02/06/2026

[CVE-2026-28299] SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when ex…

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10607] A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspec…

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dede_htmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10608] A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the fi…

A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyaction.php. The manipulation of the argument postname/des results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10617] A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the…

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2019-25722] Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded…

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and al…

nvdaltovulnerabilidad CVSS 7.6 NVD

G Crítico vulnerabilidad

02/06/2026

[CVE-2026-42074] OpenClaude is an open-source coding-agent command line interface for cloud and local model providers…

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema, meaning the LLM (an untrusted principal per the project's own threat model) can set it to true in any tool_use response. Combined with the default allowUnsandboxedCommands: true setting…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10606] A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of th…

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45685] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads …

nvdaltovulnerabilidad CVSS 7.5 NVD