Alertas de Seguridad de la Información

T Alto vulnerabilidad

05/06/2026

[CVE-2026-45743] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can read, write, delete, download, and execute files on the vic…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45327] TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent…

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcry…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45290] Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v…

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260417.085727-30` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a vulnerability in Network to stall the netty event loop, rendering it inoperable. All consumers of the library should upgrade to at le…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45291] Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v…

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260418.124334-32` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least ve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-36500] An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to e…

An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-36501] An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to ca…

An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11342] A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affec…

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11344] A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown fu…

A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71317] NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants…

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71318] NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remo…

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — includin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD

B Crítico vulnerabilidad

05/06/2026

[CVE-2026-11362] DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog:…

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

B Crítico vulnerabilidad

05/06/2026

[CVE-2026-9270] DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does …

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta v…

nvdcriticovulnerabilidad CVSS 9.1 NVD

7 Alto vulnerabilidad

05/06/2026

[CVE-2026-48095] 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buff…

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11334] A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec8…

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Conti…

nvdaltovulnerabilidad CVSS 7.3 NVD

P Crítico vulnerabilidad

05/06/2026

[CVE-2026-10879] DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more tha…

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50231] Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to exe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50232] Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50234] Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack…

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

nvdaltovulnerabilidad CVSS 7.5 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50264] An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuff…

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD