Alertas de Seguridad de la Información

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53284] In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty p…

In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes [WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time: BTRFS critical (device dm-2 state E): emergency shutdown …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-52783] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenP…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage..httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-49991] RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users wi…

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry ke…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-32833] Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerabili…

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code executio…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

26/06/2026

[CVE-2026-47220] Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 u…

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56876] extract-zip does not validate symlink targets when extracting zip archives. When processing a malici…

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-9640] A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.…

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys …

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-12411] Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust…

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

nvdaltovulnerabilidad CVSS 8.4 NVD

I Alto vulnerabilidad

26/06/2026

[CVE-2026-45195] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-0828] Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11…

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57628] Administrator SQL Injection in WP All Import <= 4.0.1 versions.

Administrator SQL Injection in WP All Import

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57631] Administrator SQL Injection in Popup box <= 6.0.1 versions.

Administrator SQL Injection in Popup box

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57315] Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54839] Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &a…

Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54832] Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

Unauthenticated Broken Access Control in Gutenverse Companion

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-30041] An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to ex…

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57915] It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA …

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-40711] Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-power…

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-11625] Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. …

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

nvdaltovulnerabilidad CVSS 7.5 NVD