Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/06/2026

[CVE-2026-44168] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-9638] Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These ve…

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6211] Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc.…

Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WEOLL: from 2.0.9 before 3.2.45.33.

nvdaltovulnerabilidad CVSS 8.7 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses…

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-6893] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This all…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-50637] Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectio…

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. V…

nvdaltovulnerabilidad CVSS 8.2 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52750] Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows …

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3326] The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before usi…

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-8071] The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize …

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-46746] A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application…

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The application does not properly sanitize user input in the /api/sftp/uploadFiles endpoint, allowing the injection of shell command payloads via crafted directory names. These payloads are stored and executed when directory listings are retrieved. This could allow an authenticated remote attacker to execute arbit…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46311] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c0…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

08/06/2026

[CVE-2026-49233] Routinator does not properly check the module component of rsync URIs, which are used to create the …

Routinator does not properly check the module component of rsync URIs, which are used to create the file system paths for the Routinator cache. This allows for path traversal by having a module name containing .., potentially providing an attacker access to the entire Routinator rsync cache.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-3238] A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Control…

A flaw was found in Samba’s WINS server component when running as an Active Directory Domain Controller. The WINS protocol handlers for certain request types did not properly validate incoming packets, allowing an unauthenticated remote attacker to trigger a NULL pointer dereference and crash the WINS service using specially crafted UDP packets.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

06/06/2026

[CVE-2026-10725] Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inb…

Protocol::HTTP2 versions before 1.13 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode method materialises a full key+value copy per indexed reference with no running size check, and the stream_header_block_add method appends (since vers…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-67448] The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The …

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS messages before storing and displaying them. An attacker can send an SMS containing a malicious XSS payload, which will be executed in the context of the victim's browser when the message is viewed.

nvdaltovulnerabilidad CVSS 7.1 NVD

R Alto vulnerabilidad

04/06/2026

[CVE-2026-49941] Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called …

Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and passed back to itself as a 32-bit or 128-bit netmask. If the argument was not a well-formed IP address, then this would lead to indefinite recursio…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

04/06/2026

[CVE-2026-49942] Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a…

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to accept larger networks. Leading zeros were also accepted, but treated as decimal instead of octal. This could lead to confusion about what networ…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

04/06/2026

[CVE-2026-46741] Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and value…

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git repository contains an unreleased version with the gauge and set methods that also do not check for potential metric injections.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-5228] Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile …

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

04/06/2026

[CVE-2026-8829] HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS rou…

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated…

nvdaltovulnerabilidad CVSS 7.5 NVD