Alertas de Seguridad de la Información

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64397] In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTOR…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize QUERY_DIRECTORY requests per file smb2_query_dir() stores a pointer to its stack-allocated private data in the ksmbd_file readdir_data. Concurrent QUERY_DIRECTORY requests using the same file handle can overwrite this pointer while an iterate_dir() callback is still using it, resulting in a stack use-after-free.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64390] In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection own…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: track the connection owning a byte-range lock SMB2_LOCK adds each granted byte-range lock to both the file lock list and the lock list of the connection which handled the request. The final close and durable handle paths, however, remove the connection list entry while holding fp->conn->llist_lock. With SMB3 multichanne…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64392] In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials f…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for delete-on-close Delete-on-close can be completed by deferred or durable handle teardown, where no request work is available. Both the base-file unlink and the ADS xattr removal consequently run with the ksmbd worker credentials and can bypass filesystem permission checks. Run both operations wi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64368] In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing t…

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when only red zoning is enabled When init (zeroing) on allocation is requested, for kmalloc() we generally have to zero the full object size even if a smaller size is requested, in order to provide krealloc()'s __GFP_ZERO guarantees. But if we track the requested size, krealloc() uses …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64361] In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow i…

In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length check_and_correct_requested_length() compares (off + len) against node_size using u32 arithmetic. When the caller passes a large len value (e.g. from an underflowed subtraction in hfs_brec_remove()), off + len can wrap past 2^32 and produce a small result, caus…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64312] In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callba…

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() returns -EBUSY, pcrypt falls back to calling the child AEAD directly. That fallback must not keep the padata completion callback. Otherwise…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64259] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on …

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: make a fuse_req on SQE commit only findable after memcpy Bad userspace might try to trick us and send commit SQEs request unique / commit-id of requests that are not even send to fuse-server (io_uring_cmd_done() not called) yet. fuse_uring_commit_fetch() ends the fuse request when the ring entry has a wrong state, b…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64260] In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stoppe…

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: Avoid queue->stopped races and set/read that value under lock There are several readers of queue->stopped that check the value under lock, but fuse_uring_commit_fetch() did not and actually the value was not set under the lock in fuse_uring_abort_end_requests() either. Especially in fuse_uring_commit_fetch it is impo…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64265] In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_…

In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dan…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64266] In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before re…

In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before returning from fuse_ref_folio() fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, lead…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-17107] A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Manag…

A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-64232] In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s…

In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's unde…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-57106] Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privil…

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45815] Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R…

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45816] NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This req…

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-15704] In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln…

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-12736] The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and incl…

The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) passing the request-supplied 'option' and 'data' parameters directly to update_option() without any option-name allowlist or value sanitization, while the permission_callback only verifies the…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-56167] Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privi…

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65604] Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open …

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forb…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65694] Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller …

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive file…

nvdaltovulnerabilidad CVSS 7.5 NVD