Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16632] A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_proto…

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65318] Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerab…

Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can connect to the /ws/import_files WebSocket endpoint without authentication, specify arbitrary URLs in the HT…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16405] Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Fire…

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-63767] ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserializa…

ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell command…

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-55626] xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session …

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using the Xvnc backend over UNIX domain sockets, the Xvnc process is launched with insufficient authentication mechanisms. A local authenticated attacker could exploit this vulnerability to bypass intended session isolation, allowing them to unauthorizedly view or control the active d…

nvdaltovulnerabilidad CVSS 8.0 NVD

S Alto vulnerabilidad

20/07/2026

[CVE-2026-63760] SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON p…

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

20/07/2026

[CVE-2026-63747] SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler tha…

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64115] In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer r…

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64044] In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in …

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMD_NEW_PEER error path ovpn_nl_peer_new_doit()'s error path calls ovpn_peer_release() directly rather than ovpn_peer_put(), bypassing the kref. The accompanying comment ("peer was not yet hashed, thus it is not used in any context") holds for UDP but not for TCP. For UDP, the ovpn_socket union us…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64045] In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer poi…

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpn_tcp_close() ovpn_tcp_close() loads the ovpn_socket via rcu_dereference_sk_user_data() under rcu_read_lock(), takes a reference on sock->peer, caches the peer pointer in a local, and drops the read lock. It then passes sock->peer (rather than the cached local) to ovpn_peer_del(), re-der…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64010] In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free r…

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet (CC) can be processed concurrently with socket release. This can lead to a use-after-free of the socket object. When nfc_llcp_recv_cc() moves the socket from the conne…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-64011] In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcp_sock_release() llcp_sock_release() unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by checking the socket state and unlinking from the correct list.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63979] In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pin…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63980] In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh…

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spin_lock_bh for hn_lock nvmet_tcp_state_change(), a socket callback that runs in BH context, can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(). handshake_req_cancel() acquires hn->hn_lock with plain spin_lock(). If a process-context thread on the same CPU hol…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63971] In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wai…

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctp_wait_for_connect and peeloff sctp_wait_for_connect() drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the association to a new socket via getsockopt(SCTP_SOCKOPT_PEELOFF), changing asoc->base.sk. After re…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63945] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_s…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock iso_sock_close() calls iso_sock_clear_timer() before acquiring lock_sock(sk). iso_sock_clear_timer() reads iso_pi(sk)->conn twice without the socket lock held: if (!iso_pi(sk)->conn) return; cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); Co…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63914] In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notificatio…

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate() in net/xfrm/xfrm_user.c and pfkey_send_migrate() in net/key/af_key.c both hardcode &init_net for the multicast that announces a successful XFRM_MSG_MIGRATE / SADB_X_MIGRATE. XFRM_MSG_MIGRATE arrives on a per-netns NETLINK_XFRM socket, and the rest of the xf…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-63828] In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit …

In the Linux kernel, the following vulnerability has been resolved: apparmor: mediate the implicit connect of TCP fast open sendmsg sendmsg()/sendto() with MSG_FASTOPEN is a combination of connect(2) and write(2): it opens the connection in the SYN. apparmor_socket_sendmsg() only checks AA_MAY_SEND, so a profile that grants send but denies connect lets a confined task open an outbound TCP/MPTCP …

nvdaltovulnerabilidad CVSS 8.4 NVD

L Alto vulnerabilidad

19/07/2026

[CVE-2026-53389] In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free …

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in del_async path In tcp_ao_delete_key(), the del_async path skips the current_key and rnext_key validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN sockets. However, if a key was added with set_current=1/set_rnext=1 while the socket was in CLO…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

18/07/2026

[CVE-2026-15631] Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the reso…

Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. The WebSocket routing path in WebSocketProxy.findUpstream resolves the destination via the WHATWG URL constructor, which collapses dot segments, so a crafted upgrade request with path traversal sequences can escape the rewrite pr…

nvdaltovulnerabilidad CVSS 8.7 NVD