Alertas de Seguridad de la Información

R Alto vulnerabilidad

25/06/2026

[CVE-2026-11800] A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr…

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized acces…

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-12975] A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParse…

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via ex…

nvdaltovulnerabilidad CVSS 8.5 NVD

F Alto vulnerabilidad

25/06/2026

[CVE-2025-71328] Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user ca…

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an att…

nvdaltovulnerabilidad CVSS 8.3 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-6731] X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certific…

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-55960] Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain v…

Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative() accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer. The check now defaults the expected type to X.509 (per RFC 7250/8446) when no type was negotiated,…

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-11310] X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert…

X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra (OPENSSL_EXTRA) and whose application validates certificates by calling X509_verify_cert() with caller-supplied untrusted intermediate certificates; for those users it is critical, otherwise the library is unaffected. In particular, native wol…

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-12340] Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificat…

Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 signature, the Subject Key Identifier computation reads the trailing 65 bytes of the public key without checking that the key is at least that long. A public key shorter than 65 bytes results in an out-of-bounds heap read, leading to a potential crash (denial of service); there is …

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

25/06/2026

[CVE-2026-49839] jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-str…

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too lo…

nvdaltovulnerabilidad CVSS 7.1 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-11999] X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (…

X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those users it is critical, otherwise the library is unaffected. Native wolfSSL TLS/DTLS usage is not impacted. X509_verify_ce…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

25/06/2026

[CVE-2026-55092] Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.…

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the l…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54848] Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for …

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

nvdaltovulnerabilidad CVSS 8.3 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-47150] In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds…

In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.

nvdaltovulnerabilidad CVSS 7.1 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-47151] In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds w…

In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.

nvdaltovulnerabilidad CVSS 7.1 NVD

D Alto vulnerabilidad

25/06/2026

[CVE-2026-46734] Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certifica…

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-47147] In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-…

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53255] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate adver…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate advertising TLV before type checks tlv_data_is_valid() reads each advertising data field length from data[i], then inspects data[i + 1] for managed EIR types before checking that the current field still fits inside the supplied buffer. A malformed field whose length byte is the last byte of the buffer …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53240] In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is st…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53209] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject ove…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend Existing advertising instances can already hold the maximum extended advertising payload. When hci_adv_bcast_annoucement() prepends the Broadcast Announcement service data to that payload, the combined data may no longer fit in the temporary buffer used to rebu…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53194] In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bu…

In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer overflow klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but pa…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53185] In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zra…

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still i…

nvdaltovulnerabilidad CVSS 7.8 NVD