Alertas de Seguridad de la Información

D Alto vulnerabilidad

14/07/2026

[CVE-2026-60114] Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability…

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of …

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

14/07/2026

[CVE-2026-58476] Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery v…

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing administrative actions by luring a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. Attackers can trigger actions such as disabling the passph…

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

14/07/2026

[CVE-2026-58477] Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerabilit…

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-51105] Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a den…

Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP_SERVERMESSAGE Handler.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15736] Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: I…

Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the applica…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15694] A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind o…

A vulnerability was detected in Tenda BE12 Pro 16.03.66.23. Impacted is the function fromSetIpBind of the file /goform/SetIpBind. The manipulation of the argument page results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15695] A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpLi…

A flaw has been found in Tenda BE12 Pro 16.03.66.23. The affected element is the function fromDhcpListClient of the file /goform/DhcpListClient. This manipulation of the argument page causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15696] A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function f…

A vulnerability has been found in Tenda BE12 Pro 16.03.66.23. The impacted element is the function fromVirtualSer of the file /goform/VirtualSer. Such manipulation of the argument page leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-14903] Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker t…

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10669] On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xte…

On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10671] In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kerne…

In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10672] subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static…

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15693] A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the fun…

A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8314] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the sim…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8085] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the mod…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8312] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the exp…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8313] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the lin…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15692] A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the functio…

A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15691] A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSaf…

A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54429] A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices d…

A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected applicatio…

nvdaltovulnerabilidad CVSS 7.4 NVD