Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

01/07/2026

[CVE-2026-24260] NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-…

NVIDIA Container Toolkit for Linux contains a vulnerability where an attacker could cause a time-of-check time-of-use race condition. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, and data tampering.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24264] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improp…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause improper handling of highly compressed data. A successful exploit of this vulnerability might lead to denial of service.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24240] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24242] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side …

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24243] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24244] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24245] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13706] Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability i…

Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13707] Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated wit…

Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.

M Crítico vulnerabilidad

01/07/2026

[CVE-2025-15646] HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the …

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format =…

M Crítico vulnerabilidad

01/07/2026

[CVE-2025-23350] NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user wi…

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

M Crítico vulnerabilidad

01/07/2026

[CVE-2025-23351] NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user wi…

NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bounds by crafted input. A successful exploit of this vulnerability may lead to arbitrary code execution on the device.

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6688] FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs lon…

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H…

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6682] In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= f…

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/up…

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6687] FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XD…

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-23537] A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that all…

A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requir…

R Alto vulnerabilidad

01/07/2026

[CVE-2026-5136] A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignme…

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege es…

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-57692] Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. T…

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2.

L Alto vulnerabilidad

01/07/2026

[CVE-2026-53356] In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread…

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix phys BO pread/pwrite with offset sg_page() returns struct page pointer not (void *) so the scaling of pread/pwrite is wrong for phys BO and wrong parts of BO would be accessed if non-zero offset is used. Last impacted platform with overlay or cursor planes using phys mapping was Gen3/945G/Lakeport. (cherry pi…

L Alto vulnerabilidad

01/07/2026

[CVE-2026-53354] In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI er…

In the Linux kernel, the following vulnerability has been resolved: arm64: errata: Mitigate TLBI errata on various Arm CPUs A number of CPUs developed by Arm suffer from errata whereby a broadcast TLBI;DSB sequence may complete before the global observation of writes which are translated by an affected TLB entry. These errata ONLY affect the completion of memory accesses which have been transla…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?