Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/06/2026

[CVE-2024-39575] update_disk_psu_baseline.sh requires password in plain text

update_disk_psu_baseline.sh requires password in plain text

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-48780] Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously craft…

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email ad…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52697] Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Subscriber SQL Injection in Taskbuilder

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48966] Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48867] Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40787] Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20072] BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unaut…

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user inf…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12220] A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgra…

A vulnerability has been found in Yealink SIP-T46U 108.86.0.118. This affects the function mod_upgrade.SparePartsUpload of the file /api/upgrade/accupgradebychunk of the component Firmware Chunk Upload handler. Such manipulation of the argument uid leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may b…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12221] A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the…

A vulnerability was found in Yealink SIP-T46U 108.86.0.118. This impacts the function sprintf of the file /api/upgrade/upgrade of the component Firmware Chunk Upload Handler. Performing a manipulation of the argument uid/start_offset results in stack-based buffer overflow. The attack needs to be approached within the local network. The exploit has been made public and could be used. The vendor was…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12218] A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function S…

A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12214] A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the …

A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring Logic. Performing a manipulation of the argument NetworkAddr results in protection mechanism failure. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12197] A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function n…

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. T…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12186] A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_co…

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is abl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-54229] A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir …

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts ar…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6676] Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed PO…

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9033] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9032] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Win…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-14098] Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when…

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

nvdaltovulnerabilidad CVSS 7.7 NVD