Alertas de Seguridad de la Información

A Alto vulnerabilidad

27/07/2026

[CVE-2026-45112] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. …

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-48144] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings…

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-48145] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. …

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-48586] Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++,…

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Medio vulnerabilidad

27/07/2026

iOS 26.6 (23G71)

Apple lanza actualización de seguridad para iOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-moviliosiphone Apple Security

A Medio vulnerabilidad

27/07/2026

iPadOS 26.6 (23G71)

Apple lanza actualización de seguridad para iPadOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilipadosipad Apple Security

A Medio vulnerabilidad

27/07/2026

macOS 26.6 (25G72)

Apple lanza actualización de seguridad para macOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilmacos Apple Security

A Medio vulnerabilidad

27/07/2026

tvOS 26.6 (23L773)

Apple lanza actualización de seguridad para tvOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-moviltvos Apple Security

A Medio vulnerabilidad

27/07/2026

visionOS 26.6 (23O770)

Apple lanza actualización de seguridad para visionOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilvisionos Apple Security

A Medio vulnerabilidad

27/07/2026

watchOS 26.6 (23U67)

Apple lanza actualización de seguridad para watchOS versión 26.6. Esta actualización incluye parches de seguridad importantes. Se recomienda actualizar de inmediato en todos los dispositivos Apple.

seguridad-movilwatchos Apple Security

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17527] In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to p…

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source n…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17523] A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user …

A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64531] In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversi…

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guar…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64532] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.da…

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the memmove destination is `Add2Ptr(e, le16_to_cpu(e->view.data_off))`, where e->view.data_off comes from an on-disk NTFS_DE inside an INDEX_ROOT or …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64533] In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow …

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying version 0 restart tables. During this conversion, the memmove() length is derived directly from the on-disk lcns_follow field: memmove(&dp->vcn, &dp0->vcn_low, 2 * sizeof(u64) + …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64534] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED be…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_liv…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64535] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF wh…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64536] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE->element_id and pIE->length are read without checking that i + sizeof(*pIE)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14837] Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH …

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-9830] The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its…

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

nvdaltovulnerabilidad CVSS 8.2 NVD