Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28740] Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj…

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-22555] Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first…

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-24451] Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public t…

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-25038] Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-25712] Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for…

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-14605] A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the funct…

A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-14606] A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function…

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for a…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58379] A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulner…

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an ov…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-13341] A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.…

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

nvdaltovulnerabilidad CVSS 7.4 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-9545] In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it m…

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLY…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-9546] A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared…

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended serve…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-9547] When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURL…

When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fa…

nvdaltovulnerabilidad CVSS 7.4 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-12064] When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a dis…

When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-4967] In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to rem…

In IMS, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed.

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-11352] An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote de…

An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-13040] The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cro…

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter in all versions up to, and including, 9.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte…

nvdaltovulnerabilidad CVSS 7.2 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-12413] An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Contin…

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-58460] react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-residen…

react-native-receive-sharing-intent contains a path traversal vulnerability that allows a co-resident malicious application to write files outside the intended cache directory by supplying a crafted _display_name value containing dot-dot path components through a malicious ContentProvider. Attackers can fire an explicit ACTION_SEND intent at the consuming app's exported share-receiver activity to …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-38970] pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/mode…

pdfcpu through v0.11.1 contains an uncontrolled-recursion denial-of-service issue in pkg/pdfcpu/model/parse.go. The parser descends recursively through nested PDF objects, including arrays, via ParseObjectContext() and parseArray() without enforcing a maximum nesting depth.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-52189] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_487330 component

nvdaltovulnerabilidad CVSS 7.5 NVD