Alertas de Seguridad de la Información

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…

Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…

nvdaltovulnerabilidad CVSS 7.3 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50136] Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an una…

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a wo…

nvdaltovulnerabilidad CVSS 7.4 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-52884] Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT…

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a trusted directory prefix passes the check while resolving to an untrusted location. The CVE-2026-48800…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-46710] Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a…

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writab…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55188] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an aut…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53322] In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs befo…

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function On device shutdown, make vfio_pci_core_close_device() call vfio_pci_dma_buf_cleanup() before the function is disabled via vfio_pci_core_disable(). This ensures that all access via DMABUFs is revoked before the function's BARs become inaccessible. This fixes an issue where, i…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53300] In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-af…

In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue [1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buffer. If the buffer has already been reallocate…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53303] In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list re…

In the Linux kernel, the following vulnerability has been resolved: f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() In f2fs_sbi_show(), the extension_list, extension_count and hot_ext_count are read without holding sbi->sb_lock. If a concurrent sysfs store modifies the extension list via f2fs_update_extension_list(), the show path may read inconsistent count and array conten…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53294] In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't fr…

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53296] In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free cha…

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free channels on probe error On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53286] In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-a…

In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-after-free in aux device error paths When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release call…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53290] In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this drops the last reference, the device structures could be freed while the subsequent cleanup code still accesses them, leading to a use-aft…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53284] In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty p…

In the Linux kernel, the following vulnerability has been resolved: btrfs: only release the dirty pages io tree after successful writes [WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time: BTRFS critical (device dm-2 state E): emergency shutdown …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53281] In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer …

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d ("iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE") fixed a NULL pointer dereference in an unlikely situation partly. If dev_pasid is not found in the dev_pasids list, it remains NULL. However, the teardown operations are executed uncondition…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-52783] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenP…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth access_token plaintext to Rails.cache under the deterministic key storage..httpx_access_token, repopulated continuously by an hourly cron and every userless-OAuth call site (see Write cadence). None of the three allowed cache…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-52784] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter "user[admin]". This vulnerability is fixed in 17.3.3 and 17.4.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-49991] RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users wi…

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: No ../ sanitization in tar entry ke…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-47193] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-32833] Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerabili…

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code executio…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

26/06/2026

[CVE-2026-47220] Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 u…

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.37.0 until 1.37.5 and 1.38.3, when the %REQUESTED_SERVER_NAME(X:Y)% is used in log format and host related options is specified, like HOST_FIRST, SNI_FIRST, it's possible to crash Envoy when the specified host header is missing in the request headers. This vulnerability is fixed in 1.37.5 and 1.38.3.

nvdaltovulnerabilidad CVSS 7.5 NVD