Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10777] A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8…

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10771] A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntit…

A vulnerability was found in crmeb crmeb_java 1.4. Affected is the function RestTemplate.getForEntity of the file crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java of the component base64 Qrcode Endpoint. The manipulation of the argument url results in server-side request forgery. The attack can be executed remotely. The exploit has been made public and could be used. The proj…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44609] Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: …

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44682] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50033] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-42061] Local privilege escalation due to excessive permissions assigned to child processes. The following p…

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2026-8874] Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords …

Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API. Other endpoints in the same extension correctly fetch IWF and CIPA data over HTTPS, demonstrating an inconsistent implementation of TLS.

nvdaltovulnerabilidad CVSS 7.1 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2026-8879] Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content sc…

Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2026-8888] Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-pr…

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp() without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in denial of service on all browsing.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46265] In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM wa…

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix WQ_MEM_RECLAIM warning When sunrpc is used, if a reset triggered, our wq may lead the following trace: workqueue: WQ_MEM_RECLAIM xprtiod:xprt_rdma_connect_worker [rpcrdma] is flushing !WQ_MEM_RECLAIM hns_roce_irq_workq:flush_work_handle [hns_roce_hw_v2] WARNING: CPU: 0 PID: 8250 at kernel/workqueue.c:2644 check_fl…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46267] In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers an…

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

03/06/2026

[CVE-2026-46264] In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initializa…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Fix sysfs initialization In case of devm_add_action_or_reset() failure the provided cleanup action will be run immediately on the not yet initialized kobject. This may lead to errors like: [ ] kobject: '(null)' (ff110001393608e0): is not initialized, yet kobject_put() is being called. [ ] WARNING: lib/kobject.c:734…

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

03/06/2026

[CVE-2026-40290] OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel r…

OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 3.16.0 and prior to 4.11.0, a user-after-free (UAF) race condition exists in the shared memory teardown logic of FF-A within OP-TEE SPMC/SP flows. This only applies when OP-TEE is configured as an SPMC for S-EL0 SPs, …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36611] Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w…

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37462] An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows …

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37460] Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.…

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10704] A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulne…

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the function Login of the file /admin/admin_class_novo.php of the component Administrative Control Panel. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10694] A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this iss…

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

03/06/2026

[CVE-2026-9516] Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input …

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-35482] alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meet…

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environme…

nvdaltovulnerabilidad CVSS 8.0 NVD