Alertas de Seguridad de la Información

E Alto vulnerabilidad

26/06/2026

[CVE-2026-47220] Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 u…

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56876] extract-zip does not validate symlink targets when extracting zip archives. When processing a malici…

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-9640] A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.…

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys …

nvdaltovulnerabilidad CVSS 7.2 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-12411] Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust…

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

nvdaltovulnerabilidad CVSS 8.4 NVD

I Alto vulnerabilidad

26/06/2026

[CVE-2026-45195] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outside the permitted range of memory for the host kernel. Addresses passed to the GPU Firmware can be used by the Firmware for more privileged memory accesses than are permitted by the system.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-0828] Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11…

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57628] Administrator SQL Injection in WP All Import <= 4.0.1 versions.

Administrator SQL Injection in WP All Import

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57631] Administrator SQL Injection in Popup box <= 6.0.1 versions.

Administrator SQL Injection in Popup box

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57315] Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.45 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54839] Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &a…

Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54832] Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

Unauthenticated Broken Access Control in Gutenverse Companion

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-30041] An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to ex…

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57915] It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA …

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-40711] Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-power…

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-11625] Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. …

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-11702] Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked proce…

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57876] An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and…

An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing HTTP request body data. A remote attacker may exploit this vulnerability by sending a crafted request with excessive input, causing memory corruption and resulting in a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

26/06/2026

[CVE-2026-2053] The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not suffi…

The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of ser…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-10835] The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a para…

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 7.7 NVD