Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17527] In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to p…

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source n…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64534] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED be…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_liv…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64535] In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF wh…

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data digest is enabled on an NVMe/TCP connection and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based data transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit() — which p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14837] Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH …

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-13714] The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate th…

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve rem…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-13726] The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it…

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-12255] The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site…

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-12394] The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end reg…

The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-13152] The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent …

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-13332] The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unaut…

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-15662] The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not r…

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal r…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17496] NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injec…

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to inc…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17497] NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,…

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-63720] datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows…

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, cau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64510] In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit…

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup If acpi_nfit_init() fails after adding the acpi_desc object to the acpi_descs list, that object is never removed from that list because the acpi_nfit_shutdown() devm action is not added for the NFIT device in that case. Next, the acpi_nfit_init() failure causes acpi_nfit_prob…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64496] In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO rese…

In the Linux kernel, the following vulnerability has been resolved: iio: event: Fix event FIFO reset race `iio_event_getfd()` creates the event file descriptor with `anon_inode_getfd()`, which allocates a new fd, creates the anonymous file and installs it in the process fd table before returning to the caller. The IIO code resets the event FIFO after `anon_inode_getfd()` has returned, but befor…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64467] In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride w…

In the Linux kernel, the following vulnerability has been resolved: rust_binder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array (binder_size_t = u64 entries), cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry read. On 64-bit kernels (usize == u64) this is harmless, but on 32-bit kernels it walks the 8-b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64475] In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbit…

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on register_device() failure The re-order in the Fixes commit below displaced vfio_pci_vga_init() as the last failure point of what is now vfio_pci_core_register_device() without introducing an unwind for the VGA arbiter registration. In current kernels this is mostly benign because vfio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64452] In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-afte…

In the Linux kernel, the following vulnerability has been resolved: 6lowpan: fix NHC entry use-after-free on error path lowpan_nhc_do_uncompression() looks up an NHC descriptor while holding lowpan_nhc_lock. If the descriptor has no uncompress callback, the error path drops the lock before printing nhc->name. lowpan_nhc_del() removes descriptors under the same lock and then relies on synchroni…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64444] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop The IE parsing loop in OnAssocRsp() advances by (pIE->length + 2) each iteration but only guards on i < pkt_len. When a malicious AP sends an AssocResponse whose last IE has only one byte remaining in the frame (the element_id byte lands at pkt_len-1), the loop reads pIE->…

nvdaltovulnerabilidad CVSS 8.1 NVD