Alertas de Seguridad de la Información

C Alto vulnerabilidad

15/06/2026

[CVE-2026-20262] Vulnerabilidad explotada activamente en Cisco Catalyst SD-WAN Manager

CISA confirma explotación activa de una vulnerabilidad en Cisco Catalyst SD-WAN Manager. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-29.

ciscoexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12187] A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulner…

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12186] A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_co…

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is abl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-54410] nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function …

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state stru…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-54413] driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read i…

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads …

nvdaltovulnerabilidad CVSS 8.2 NVD

D Alto vulnerabilidad

13/06/2026

[CVE-2026-12174] A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the functi…

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-6428] SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before…

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-5513] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user ac…

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

13/06/2026

[CVE-2026-11769] We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity secur…

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-54228] A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetEl…

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6676] Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed PO…

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-12068] Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may al…

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9033] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9032] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Win…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-14098] Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when…

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-53868] Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register acco…

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53836] OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command h…

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53828] OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling t…

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access control, potentially executing privileged commands from unauthorized users.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53829] OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticat…

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53831] OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowli…

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

nvdaltovulnerabilidad CVSS 8.3 NVD