Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/08/2026

[CVE-2026-46369] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_valid_at, allowing a remote attacker to replay the same signed transaction during a blocks_per_batch minus one block window and cause the sender …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-58474] whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that …

whichllm before 0.5.16 contains a code injection vulnerability in the run and snippet commands that allows a remote attacker who controls a HuggingFace repository to achieve arbitrary code execution by crafting a malicious GGUF filename containing double quotes or other special characters. The script generation function in cli.py interpolates HuggingFace-derived values, including GGUF variant file…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-32257] Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Pr…

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting against backend users. This issue is f…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-32258] Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Fr…

Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS parser and rendered without sanitization on every backend page, allowing stored cross-site scripting. This issue is fixed in version 1.2.13.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81027] one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a r…

one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only after model.IsAdmin succeeds and otherwise rejects the caller, while the path-parameter branch sets the selected-channel value from c.Param("channelid") with no r…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80426] FiftyOne renders a dataset field's description as markup. The sidebar field-information component at…

FiftyOne renders a dataset field's description as markup. The sidebar field-information component at app/packages/core/src/components/FieldLabelAndInfo/index.tsx passes the description string to React's dangerouslySetInnerHTML, and no layer between storage and render escapes or sanitises it; the neighbouring info values in the same component are rendered as React children and are escaped, so the d…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80427] bestzip builds the argument list for the system zip utility without separating options from operands…

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name t…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80579] In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode befo…

In the Linux kernel, the following vulnerability has been resolved: fbdev: clear fb_info->mode before deleting a videomode fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode. fb_info->…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80580] In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output …

In the Linux kernel, the following vulnerability has been resolved: fbdev: bound mode sysfs output to the sysfs buffer mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80572] In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer …

In the Linux kernel, the following vulnerability has been resolved: Input: byd - synchronize timer deletion before freeing private data byd_disconnect() uses timer_delete() before freeing the driver's private data. This does not wait for a running byd_clear_touch() callback, which dereferences the private data and its psmouse pointer. A callback racing with disconnect can therefore access the …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80578] In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desync…

In the Linux kernel, the following vulnerability has been resolved: fbdev: core: Fix pointer desynchronization in fb_io_read() In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to a faulty user buffer), the loop adjusts the chunk size 'c' and updates the remaining 'count'. However, the hardware 'src' pointer has already been eagerly advanced by the original chunk size. If th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80570] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero re…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - zero report size on F54 work error In rmi_f54_work(), if an error occurs during report request or command verification, the code jumped directly to the 'error' label, bypassing the 'abort' label where f54->report_size was normally zeroed out. This left f54->report_size containing its previous successful …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80555] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Free all memory if cp_init() fails The routine cp_free() is called to unpin/free any memory once an I/O is completed successfully, or if cp_prefetch() fails. But if cp_init() fails, and cp->initialized is not enabled, the same routine cannot be used to free all the memory. An attempt to address this exists in ccw…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80559] In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device…

In the Linux kernel, the following vulnerability has been resolved: Input: sur40 - fix input device registration ordering In sur40_probe(), input_register_device() was previously called early before the V4L2 video device and vb2_queue components were fully initialized. If userspace opened the input device immediately upon registration, sur40_open() would trigger and start the sur40_poll() worker…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80549] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Move cp cleanup out of not operational The fsm_notoper() routine is called when the device has been lost, and is (by definition) no longer operational. Since this can happen asynchronously from the normal behavior of the driver, the cleanup may happen when holding other locks in the calling sequence (notably, the …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80553] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing …

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Cancel existing workqueues The initialization of the io_work and crw_work workqueues begs the question of whether they should be un-initialized. Add the corresponding cleanup tags in _release_dev to ensure work isn't dispatched after the private struct is free'd.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80545] In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB …

In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Improve EP11 CPRB length and overflow checks The xcrb_msg_to_type6_ep11cprb_msgx() function lacks proper input validation, creating security vulnerabilities: 1. Missing minimum size validation: The ep11_cprb structure and subsequent payload fields (pld_tag, pld_lenfmt) are copied from userspace without verifyi…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80521] In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in un…

In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a sm…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80522] In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->crypt…

In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() Perform rctx->cryptlen calculation in tegra_gcm_do_one_req() the same way it is done in tegra_ccm_crypt_init(). The current formulae may lead to a crash if a caller does not call tegra_gcm_setauthsize() and so ctx->authsize remains zero. Then a decrypt oper…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74745] In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when …

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock. Move the restart to the async service task. T…

nvdaltovulnerabilidad CVSS 7.5 NVD