Alertas de Seguridad de la Información

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53361] In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to …

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53362] In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on th…

In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length +…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53359] In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. Th…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53360] In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scrat…

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use As per the GHCB spec, when using GHCB v2+ require the software scratch area to reside in the GHCB's shared buffer. Note, things like Page State Change (PSC) requests _rely_ on this behavior, as the guest can't provide a length when making the request, i.e. the size of…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14622] A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d…

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product ado…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71372] Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __r…

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded, bypassing Picklescan's safety checks and enabling supply-chain poisoning of shared model files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71373] picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allow…

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71375] picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning …

picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malicious pickle payloads using _operator.methodcaller that evade detection and execute arbitrary code when loaded by pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71380] The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host…

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

04/07/2026

[CVE-2026-12252] In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, Stanfor…

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. Th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71356] picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.ev…

picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. Attackers can embed undetected code in pickle files that executes remote code when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71359] picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.gramma…

picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code execution. Attackers can craft pickle files embedding dangerous code that evades picklescan detection and executes during pickle.load() deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71360] picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity fun…

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71362] picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functio…

picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed malicious code in pickle files that executes when loaded from untrusted sources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71364] picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start fun…

picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execution. Attackers can craft malicious pickle files embedding this built-in function that evade detection but execute arbitrary commands when loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71366] picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile func…

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71367] picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, all…

picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using _operator.attrgetter in reduce methods to execute arbitrary code when pickle.load() processes the file.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71369] picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.…

picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing attackers to bypass safety checks. Remote attackers can embed undetected malicious code in pickle files that executes during deserialization, enabling remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71342] picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode …

picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in pickle files that executes during pickle.load, enabling remote code execution in PyTorch models and supply chain attacks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71343] picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.Pars…

picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attackers can craft malicious pickle files with embedded code that evades detection but executes arbitrary commands when pickle.load() is called.

nvdaltovulnerabilidad CVSS 8.1 NVD