Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42462] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to v…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions …

nvdaltovulnerabilidad CVSS 7.0 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52758] Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user…

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52754] Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authen…

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise …

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52755] Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that …

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

nvdaltovulnerabilidad CVSS 7.8 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26239] A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gai…

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-8863] Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker wit…

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36806] Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflo…

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formModifyWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36809] Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflo…

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36797] Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in…

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the formIPMacBindModify function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36720] Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from use…

Insecure permissions in bookcars v8.3 allows authenticated attackers to escalate privileges from user to admin via modifying their user type.

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

09/06/2026

[CVE-2026-46330] In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP …

In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-pla…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-49141] WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine…

WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modif…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-25856] OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that…

OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C# code on the server host by creating or modifying job configurations. Attackers can leverage the plain C# execution mode, which lacks reference filtering or API restrictions, to access the file system, spawn processes, and invoke arbitrary .NET APIs…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-42863] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side valid…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11524] A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRul…

A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

05/06/2026

[CVE-2026-45745] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop (Electron) disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured Termix server. This can lead to credential theft and JWT/session theft during login and normal use. As…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2022-4992] Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG…

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or …

nvdaltovulnerabilidad CVSS 8.6 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7201] CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.…

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privile…

nvdaltovulnerabilidad CVSS 8.8 NVD