Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53156] In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: nvmem: core: fix use-after-free bugs in error paths Fix several instances of error paths in which we call __nvmem_device_put() - which may end up freeing the underlying memory and other resources - and then keep on using the nvmem structure. Always put the reference to the nvmem device as the last step before returning the error…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12244] If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR co…

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 6550…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-10086] GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 be…

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8665] OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Lin…

OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

nvdaltovulnerabilidad CVSS 7.7 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9781] Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9782] Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9783] Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vul…

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableM…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9784] Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9785] Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9786] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9787] Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vuln…

Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULogDaemon J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-7570] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

24/06/2026

[CVE-2025-60474] A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box…

A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

24/06/2026

[CVE-2025-60467] A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of …

A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9776] ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability.…

ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the writeFileToHttpServletResponse method. The issue results from the lack of proper …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9777] ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability al…

ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the restoreDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in…

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9778] ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerabi…

ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the ImportDeviceList method. The issue results from the lack of proper validation of a user-supplied path prior …

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

24/06/2026

[CVE-2026-9779] ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Exec…

ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists within the updateWar method. The issue results from an incorrect implementation of c…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55759] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from serv…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55762] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any authenticated user — including a standard user role account — can call this endpoint with {"setDeploymentAs": "new-workspace…

nvdaltovulnerabilidad CVSS 8.1 NVD