Alertas de Seguridad de la Información

G Alto vulnerabilidad

24/06/2026

[CVE-2026-12537] Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versio…

Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker to achieve pre-sandbox host-level code execution a maliciously crafted .gemini/.env file.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

24/06/2026

[CVE-2026-56351] n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft …

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integr…

nvdaltovulnerabilidad CVSS 8.2 NVD

F Alto vulnerabilidad

24/06/2026

[CVE-2026-56270] Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability i…

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Googl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56245] Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINE…

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56232] Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys pr…

Capgo before 12.128.2 fails to enforce limited_to_orgs and limited_to_apps constraints on subkeys provided via x-limited-key-id header in middlewareKey function. Attackers can bypass subkey scope restrictions by referencing their own subkeys, causing all downstream route handlers to use the unrestricted parent key instead of the scoped subkey.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-56237] Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mecha…

Capgo before 12.128.2 contains a broken authentication vulnerability in its API key generation mechanism. API keys are exposed in frontend requests, and the backend fails to validate that keys are securely generated and bound to the authenticated user. An attacker can tamper with the API key parameter in the generation request and supply arbitrary values, generating custom API keys without proper …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56244] Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST du…

Capgo before 12.128.2 allows non-admin API keys to read webhook signing secrets via Supabase REST due to insufficient row-level security policies on the webhooks table. Attackers can retrieve the webhook secret and forge valid X-Capgo-Signature headers to send authenticated webhook events to configured receivers, breaking webhook authenticity and integrity.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2025-71354] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.Object…

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2025-71361] picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle…

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52943] In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zeroco…

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via memcpy(), which includes the destructor_arg pointer (uarg) for MSG_ZEROCOPY skbs. Neither function calls net_zcopy_get() for the new shinfo,…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52942] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", without checking skb_mac_header_was_set(). When the MAC header is unset, mac_header is 0xffff, so the test passes and skb_mac_header(skb) returns…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52929] In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back d…

In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52931] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a nod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52932] In the Linux kernel, the following vulnerability has been resolved: xfrm: ipcomp: Free destination …

In the Linux kernel, the following vulnerability has been resolved: xfrm: ipcomp: Free destination pages on acomp errors Move the out_free_req label up by a couple of lines so that the allocated dst SG list gets freed on error as well as success.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52933] In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed compa…

In the Linux kernel, the following vulnerability has been resolved: io_uring/poll: fix signed comparison in io_poll_get_ownership() io_poll_get_ownership() uses a signed comparison to check whether poll_refs has reached the threshold for the slowpath: if (unlikely(atomic_read(&req->poll_refs) >= IO_POLL_REF_BIAS)) atomic_read() returns int (signed). When IO_POLL_CANCEL_FLAG (BIT(31)) is se…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52934] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversi…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_containe…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52935] In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an…

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52922] In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: dat: handle forward allocation error batadv_dat_forward_data() calls pskb_copy_for_clone() to duplicate an skb for each DHT candidate, but does not check the return value before passing it to batadv_send_skb_prepare_unicast_4addr(). That function dereferences the skb unconditionally, so a failed allocation triggers a…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52923] In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation t…

In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52924] In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C…

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless …

nvdcriticovulnerabilidad CVSS 9.8 NVD