Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/06/2026

[CVE-2026-10795] The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication B…

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a p…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-52726] Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42305] Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting wit…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Cont…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42558] Xibo is an open source digital signage platform with a web content management system and Windows dis…

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerabilit…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-44693] Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior…

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53738] Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in t…

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-48110] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several r…

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50131] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify pre…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46673] Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capac…

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46679] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three co…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46702] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH …

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46625] JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-…

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototyp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42462] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to v…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-44692] Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sha…

Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-2049] GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabi…

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results f…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-6893] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This all…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46529] Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si…

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PD…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50567] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/e…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50570] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability c…

nvdaltovulnerabilidad CVSS 8.5 NVD