Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93796] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX po…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwl_pcie_tx_init() fails after RX init, nic init unwinds via iwl_pcie_rx_free(). The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touch stale RX state. Set rx_pool, global_table, rxq, and alloc_page to NULL after free to mak…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93798] In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup i…

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in merge_reloc_roots() If the root we got has zero root refs in its root item, we are resetting the root's ->reloc_root without using barriers like we do everywhere else. Sashiko complained about this while reviewing another patch, and it's correct (see the Link tag below). Also, we should not clea…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93799] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate st…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate sta_id in BA window status notif BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93786] In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited P…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and default ACLs afterwards. This preserves restrictive ACL_MASK entries and prevents SMB object creation f…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93787] In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name …

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namelen) supplied by the server. The kmalloc'd SMB response buffer is bounded, but nothing checks that de.name + de.namelen still lies inside tha…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93790] In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-…

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93543] An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X…

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93288] In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait …

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() und…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93782] In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after…

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while an in-flight command still retains response iovecs translated through th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-91160] OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSoc…

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93284] In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages be…

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_migration_unlock_put_pages() clears the array as part of its cleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page informat…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93287] In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized bl…

In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMBus block transfer length data->block[0] is validated in i2c_smbus_xfer_emulated() but that check runs too late for tracepoints and is skipped entirely when the adapter provides a native smbus_xfer implementation. This allows user-controlled oversized block le…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-91122] Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0…

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the vi…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-91123] Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0…

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-88390] An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0)…

An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-88372] libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing craft…

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-88376] Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAto…

Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination, le…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-88382] hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its…

hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-79764] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing re…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-62368] Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.crea…

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session.…

nvdaltovulnerabilidad CVSS 8.1 NVD