Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64468] In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_…

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binder_free_transaction() In binder_free_transaction(), the t->to_proc is read under the t->lock. However, once the t->lock is dropped, the to_proc can die in parallel. This leads to a use-after-free error when we attempt to acquire its inner lock right afterwards: ==========================================…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64448] In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied b…

In the Linux kernel, the following vulnerability has been resolved: smb: client: restrict implied bcc[0] exemption to responses without data area smb2_check_message() has a long-standing quirk that accepts a response whose calculated length is one byte larger than the bytes actually received ("server can return one byte more due to implied bcc[0]"). This was introduced to accommodate servers tha…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64442] In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB rea…

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() Two IE parsing loops are missing the header bounds checks before they dereference pIE->length: - issue_assocreq() walks pmlmeinfo->network.ies to build the association request. If the stored IE data ends with only an element_id byte and …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64388] In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp wit…

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix chown/chgrp with SMB3 POSIX Extensions Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UI…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64395] In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read acce…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: require source read access for duplicate extents FSCTL_DUPLICATE_EXTENTS_TO_FILE passes the source file directly to vfs_clone_file_range() or vfs_copy_file_range() without checking the SMB access mask granted to the source handle. A handle opened with attribute access can consequently be used to copy file contents into an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64380] In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID l…

In the Linux kernel, the following vulnerability has been resolved: smb: client: harden POSIX SID length parsing posix_info_sid_size() reads sid[1] to obtain the subauthority count, but its existing boundary check still accepts buffers with only one remaining byte. Require two bytes before reading sid[1] so all client paths that reuse the helper reject truncated POSIX SIDs safely.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64367] In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate r…

In the Linux kernel, the following vulnerability has been resolved: HID: hid-goodix-spi: validate report size to prevent stack buffer overflow goodix_hid_set_raw_report() builds a protocol frame in a 128-byte stack buffer (tmp_buf), writing an 11-12 byte header followed by the caller-supplied report data. The HID core caps report size at HID_MAX_BUFFER_SIZE (16384) by default, while the driver …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-64298] In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in ope…

In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regardless of the O_ACCMODE access mode. nfs_open_permission_mask() builds the access mask passed to nfs_may_open(), which is the local authoriz…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-66374] Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ …

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66041] FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability…

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions. Attackers can provide a subtitle file whose second presentation has larger dimensions than its first, causing av_image_copy_plane() to copy data excee…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66032] libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_op…

libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call retur…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-65711] sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authentica…

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute arbitrary commands as the web server process user by setting a malicious backup path and triggering a backup. The FileBackupService builds a tar shell command via string concatenation, inserting the admin-configurable siteBackupPath setting without escapeshellarg() or e…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-64219] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate paylo…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async [Why&How] dc_process_dmub_aux_transfer_async() copies payload->length bytes into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(), which is a no-op in release builds. If a caller ever passes length > 16 this results i…

nvdaltovulnerabilidad CVSS 7.0 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45813] Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS serv…

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, …

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45815] Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R…

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45816] NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This req…

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45811] Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBL…

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket l…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-25800] Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting …

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64815] In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form …

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65454] Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

Contributor SQL Injection in Quiz And Survey Master

nvdaltovulnerabilidad CVSS 8.5 NVD