Alertas de Seguridad de la Información

U Alto vulnerabilidad

02/07/2026

[CVE-2026-54409] A malicious actor with access to the network and under certain conditions could exploit an Improper …

A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vulnerability found in UniFi Protect Application to bypass authentication in UniFi Protect Cameras.

nvdaltovulnerabilidad CVSS 7.5 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55110] A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin R…

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that user's session.

nvdaltovulnerabilidad CVSS 7.5 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55111] A malicious actor with access to the network could exploit a Path Traversal vulnerability found in U…

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-53358] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan time…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling…

nvdaltovulnerabilidad CVSS 8.8 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-54401] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 7.7 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-54403] A malicious actor with access to the network could exploit a Path Traversal vulnerability found in c…

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-58652] luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd se…

luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to /etc/travelmate/*.login, this is only a frontend restriction. The backend travelmate service (running as root) reads th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-11946] An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service …

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM ind…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-13251] The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and…

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14426] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14409] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14415] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

01/07/2026

[CVE-2026-54263] Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3…

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perfor…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58263] Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4…

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced…

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-58593] NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote…

NodeBB does not bind the claimed author of an inbound ActivityPub object to the authenticated remote actor. The inbound middleware verifies the HTTP-signature actor and checks the origin of object.id, but never validates that attributedTo corresponds to the sender. In the object mock, attributedTo is used directly as a uid, and actors.assert silently ignores numeric identifiers (filtering them out…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13760] OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cd…

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a…

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

01/07/2026

[CVE-2026-46680] containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1,…

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0…

nvdaltovulnerabilidad CVSS 7.8 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6688] FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs lon…

FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, fno.fname can be up to 255 characters; many callers copy it into short fixed buffers without bounds checks, causing overflow. This maps to CWE-120 (Buffer Copy without Checking Size of Input). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H…

nvdaltovulnerabilidad CVSS 7.6 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6682] In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= f…

In FatFS R0.16 and earlier contains a FAT32 integer overflow bug in mount_volume() where fasize *= fs->n_fats can wrap, leading to attacker-controlled file-size metadata and unsafe read lengths in downstream callers. This maps to CWE-190 (Integer Overflow or Wraparound). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). Remote delivery is also possible in OTA/up…

nvdaltovulnerabilidad CVSS 7.6 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-6687] FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XD…

FatFs R0.16 and earlier contains a stack overflow bug in f_getlabel() because exFAT label length (XDIR_NumLabel) is trusted without enforcing spec maximums. This maps to CWE-121 (Stack-based Buffer Overflow). Estimated CVSS v3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (7.6, High). The estimated CISA SSVC vectors are Exploitation: PoC, Technical Impact: Total.

nvdaltovulnerabilidad CVSS 7.6 NVD