Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47477] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stac…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47478] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the us…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47300] Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker t…

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47302] Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny…

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47303] Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to ele…

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47304] Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a…

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-57108] Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized at…

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-57968] Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges …

Buffer over-read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56170] Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker…

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-44795] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, …

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3,…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-53657] Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on…

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addre…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58207] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, a client able to send account-scoped connection monitoring requests could crash the server by supplying Connz pagination Offset and Limit values that overflowed internal arithmetic before the response window was safely bounded. This issue is fixed in versions 2.14.3 and 2.…

nvdaltovulnerabilidad CVSS 7.7 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58213] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as NATS protocol data to route or leafnode connections, corrupting the forwarded protocol stream and allowing injection of unintended NATS protocol operations. This is…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58250] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server during the pre-authentication leafnode handshake by sending repeated leafnode INFO protocol messages before authentication and account setup completed. This i…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58253] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58210] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

07/07/2026

[CVE-2026-13020] A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions …

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-14476] A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() funct…

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to auth…

nvdaltovulnerabilidad CVSS 8.0 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53361] In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to …

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() …

nvdaltovulnerabilidad CVSS 7.1 NVD