Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85155] WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php …

WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allows unauthenticated attackers to order results by arbitrary database columns including users.password and users.recoverPass. Attackers can exploit this ordering oracle to infer password hash values and recovery tokens, and trigger SQL errors that disclose the f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85160] AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerabili…

AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visit…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85124] @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash …

@fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escap…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85091] zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() …

zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80753] In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a mo…

In the Linux kernel, the following vulnerability has been resolved: ovpn: run deferred work on a module-owned workqueue ovpn queues several work items whose callbacks execute module text. These works currently run on the global system workqueues, so module exit has no driver-owned drain point that guarantees the callbacks have fully returned before the module text can be freed. Object reference…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80754] In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55…

In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - fix F55 transmitter electrode count typo During F55 sensor detection, the transmitter (TX) electrode count was incorrectly assigned the value of the receiver (RX) electrode count due to copy-paste typos. This incorrect value was then propagated to the driver data and used by F54 to determine the diagnost…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80745] In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNE…

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEG_table[] mapping does not match the FP9931 datasheet. The datasheet defines the VPOS/VNEG voltage mapping as: 00h-04h -> 7.04V (-7.04V) 05h -> 7.26V (-7.26V) 06h -> 7.49V (-7.49V) ... 28h-3Fh -> 15.06V (-15.06V) However, VPOSNEG_table[] ha…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80747] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check fo…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80748] In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteratio…

In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500_mmc_reorder_cmd_data() and ls2k2000_mmc_reorder_cmd_data(), the for_each_sg() macro already iterates over the scatterlist entries, with 'sg' pointing to the current entry. However, the code incorrectly uses '&sg[i]' and 'sg_dma_len(&sg[i])' inside the loop, w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80749] In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of …

In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function was copying a given audio infoframe into the connector's copy but using the size of the destination (a generic target, sized to accept many different data blocks) not the source (a very specific type of data block). Thus, it was copying 60 bytes of data from a 2…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80750] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaini…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_bus_protection_legacy() looks up several legacy bus protection regmaps from device-tree nodes. Two error paths put the device node before checking whether the regmap lookup failed, but still pass that node to dev_err_probe() with %pOF on failure. If of_node_p…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80751] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initia…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk_mfg_attach_dev() reads prev_o on the first iteration of its loop, in "if (prev_o && prev_o->freq == o->freq)", before prev_o is assigned at the end of the loop body. On that first iteration, evaluating prev_o reads an indeterminate value. If it is non-NULL, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80752] In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver …

In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() retrieves the controller state with spi_get_drvdata(), but probe never stores it, so suspend dereferences a NULL pointer. Store it during probe.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80741] In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read…

In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80734] In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping…

In the Linux kernel, the following vulnerability has been resolved: btrfs: initialize inode mapping flags for cached inodes [BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size: 795 (241074): drop_caches: 3 assertion failed: IS_ALIGNED(start, blocksize) && IS_ALIGNED(end + 1, blocksize), in extent_io.c:1404 (…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80735] In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by…

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some subsystems, like BPF SOCKMAP, set sk_user_data without actually setting the encap_type. For this reason, we must make sure that the type is the one ovpn expects before dereferencing sk_user_data. Failing to do so may lead to out-of-bounds reads.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80736] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth grou…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth group IDs range from 1 through MAX_GROUPS, while Group ID 0 is reserved. tb_consumed_dp_bandwidth() uses the Group ID directly to index its local group_reserved[] array. The array currently has MAX_GROUPS entries, so its valid indices are 0 through MAX_GROUPS…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80737] In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize…

In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: synchronize DMA teardown dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80738] In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_p…

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->sk_state != …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-80731] In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-…

In the Linux kernel, the following vulnerability has been resolved: net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header dev_validate_header() reads dev->hard_header_len directly when zero-padding short link layer headers for CAP_SYS_RAWIO holders: if (capable(CAP_SYS_RAWIO)) { memset(ll_header + len, 0, dev->hard_header_len - len); return true; } Packet send p…

nvdaltovulnerabilidad CVSS 7.8 NVD