Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/06/2026

[CVE-2026-8095] The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File …

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during u…

nvdaltovulnerabilidad CVSS 8.1 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49416] The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large valu…

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kern…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49414] The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code…

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitati…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49413] The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID …

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-gr…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49412] The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter l…

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-45258] dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset an…

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel me…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/06/2026

[CVE-2026-12415] The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing ca…

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentic…

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Alto vulnerabilidad

27/06/2026

[CVE-2023-37524] HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.…

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.  Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56414] A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticate…

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity o…

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-33560] The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are expos…

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-55069] Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability e…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack fu…

nvdaltovulnerabilidad CVSS 8.7 NVD

K Crítico vulnerabilidad

26/06/2026

[CVE-2026-49869] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authentic…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated r…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-36478] An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of se…

An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components

nvdaltovulnerabilidad CVSS 7.5 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54350] Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any p…

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write query, modifies every document of that collection with one HTTP request. enrichContext at packages/server…

nvdcriticovulnerabilidad CVSS 10.0 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-54351] Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budib…

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchron…

nvdaltovulnerabilidad CVSS 8.2 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54352] Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packag…

Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appI…

nvdcriticovulnerabilidad CVSS 9.6 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48778] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="comma…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 crea…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48800] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text con…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object w…

nvdaltovulnerabilidad CVSS 7.8 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…

Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…

nvdaltovulnerabilidad CVSS 7.3 NVD