Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/06/2026

[CVE-2025-64390] A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. …

A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through a malformed JAR file.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2021-4478] Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-boun…

Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulnerability when loading .gdt files. A crafted .gdt file can trigger a buffer overflow during file parsing, allowing an attacker to crash the application or execute malicious code on the underlying system.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2019-25722] Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded…

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and al…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10606] A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of th…

A vulnerability was determined in DedeCMS 5.7.88. The affected element is the function TrimMsg of the file /plus/feedback.php of the component Feedback Handler. Executing a manipulation of the argument msg can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-45553] NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reSt…

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42654] Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System fo…

Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Swings Wallet System for WooCommerce allows Password Recovery Exploitation. This issue affects Wallet System for WooCommerce: from n/a through 2.7.5.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40619] A high security vulnerability affecting Security Center main server installations has been identifie…

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-40780] Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP Boo…

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10629] SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec inte…

SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39552] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39553] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39555] Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. Thi…

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection. This issue affects Askka: from n/a through 1.3.1.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10621] Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via…

Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10622] Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to a…

Improper Authentication in REST API in Collibra Agent, allows a remote unauthenticated attacker to access privileged functionality via exposed '/rest/* endpoints.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-68886] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-69369] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-58707] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion. This issue affects Spin: from n/a through 1.8.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-58897] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion. This issue affects Fermentio: from n/a through 1.5.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2019-25719] Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software ver…

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-39550] Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. …

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection. This issue affects Aperitif: from n/a through 1.6.

nvdaltovulnerabilidad CVSS 8.1 NVD