Alertas de Seguridad de la Información

S Alto vulnerabilidad

09/06/2026

[CVE-2026-42567] Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an int…

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in . This issue has been patched in version 5.55.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-42570] Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't…

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in vers…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

09/06/2026

[CVE-2026-34183] Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with …

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames. Impact summary: A malicious remote peer can cause an unbounded memory allocation which can lead to an abnormal termination of the application acting as a QUIC client or server and a Denial of Service. A remote peer may exhaust heap memory by flooding the l…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-38615] DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

09/06/2026

[CVE-2026-34180] Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content …

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes in length may cause a heap buffer over-read on 64-bit Unix and Unix-like platforms. Impact summary: The heap buffer over-read may crash the application (Denial of Service) or to load into the decoded ASN.1 object contents of memory beyond the end of the input buffer. More typic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-26142] Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute c…

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-32193] Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Ku…

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24180] NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffe…

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24181] NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index …

NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-0419] Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit releas…

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure cont…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49948] Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability …

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and emb…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24064] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24065] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and th…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-10727] An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions…

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

nvdaltovulnerabilidad CVSS 7.2 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-52906] In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being…

In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, so when the user mounts with "access=us…

nvdaltovulnerabilidad CVSS 7.7 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-52907] In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off…

In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: fix off by one bugs Change these comparisons from > vs >= to avoid accessing one element beyond the end of the arrays. While at it, use ARRAY_SIZE instead of the _MAX enum values. [fix cosmetic issues]

nvdaltovulnerabilidad CVSS 7.8 NVD

L Crítico vulnerabilidad

09/06/2026

[CVE-2026-46325] In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conver…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE The current implementation incorrectly handles memory regions (MRs) with page sizes different from the system PAGE_SIZE. The core issue is that rxe_set_page() is called with mr->page_size step increments, but the page_list stores individual struct page pointers, …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46326] In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix…

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: mprls0025pa: fix spi_transfer struct initialisation Make sure that the spi_transfer struct is zeroed out before use.

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46327] In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_su…

In the Linux kernel, the following vulnerability has been resolved: dm: fix unlocked test for dm_suspended_md The function dm_blk_report_zones tests if the device is suspended with the "dm_suspended_md" call. However, this function is called without holding any locks, so the device may be suspended just after it. Move the call to dm_suspended_md after dm_get_live_table, so that the device can't…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46328] In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix …

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix rlimit for posix cpu timers Posix cpu timers requires an additional step beyond setting the rlimit. Refactor the code so its clear when what code is setting the limit and conditionally update the posix cpu timers when appropriate.

nvdaltovulnerabilidad CVSS 7.3 NVD