Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11334] A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec8…

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Conti…

nvdaltovulnerabilidad CVSS 7.3 NVD

P Crítico vulnerabilidad

05/06/2026

[CVE-2026-10879] DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more tha…

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50231] Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to exe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50232] Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50234] Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack…

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

nvdaltovulnerabilidad CVSS 7.5 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50264] An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuff…

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50258] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has mu…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may…

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50259] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() …

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50260] A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that s…

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50261] A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client …

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50256] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between …

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to c…

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50257] A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client…

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privileg…

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21035] Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to ac…

Improper input validation in Samsung Plus TV prior to version 1.0.28.6 allows remote attackers to access sensitive information.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21037] Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to acc…

Improper input validation in Samsung Members prior to version 5.8.01.5 allows local attackers to access arbitrary URL and launch arbitrary activity with Samsung Members privilege.

nvdaltovulnerabilidad CVSS 7.1 NVD

G Alto vulnerabilidad

05/06/2026

Vulnerabilidad alta en Android OS (CVE-2026-21029) con CVSS 7.8 afecta dispositivos en LATAM

Google Android ha publicado un advisory sobre una vulnerabilidad de severidad alta (CVSS 7.8) en Android OS que impacta millones de dispositivos móviles en México y Latinoamérica, representando más del 80% del parque móvil regional. Esta falla de seguridad requiere actualización inmediata en todos los equipos corporativos y personales para prevenir explotación remota.

google-androidseguridad-movilandroid-os CVSS 7.8 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21030] Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers…

Improper access control in MediaTek Audio HAL prior to SMR Jun-2026 Release 1 allows local attackers to trigger privileged functions.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21031] Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch a…

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21032] Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant pr…

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

nvdaltovulnerabilidad CVSS 7.1 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21033] Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant …

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11332] A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency speci…

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galax…

nvdaltovulnerabilidad CVSS 7.8 NVD