Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57974] Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27771] Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package s…

Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27775] Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receiv…

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27779] Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting publ…

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28699] Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed…

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28737] Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsReq…

Gitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensionsRequired field in glTF files rendered by the 3D file viewer.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28740] Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj…

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-26231] Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to …

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-26307] Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searc…

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27657] Gitea versions before 1.25.5 allow a user to change another user's primary email address.

Gitea versions before 1.25.5 allow a user to change another user's primary email address.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27660] Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the requ…

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-22555] Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first…

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-24451] Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public t…

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-24690] Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull reque…

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-25038] Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-25712] Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for…

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-20779] Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a vali…

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-14605] A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the funct…

A vulnerability was identified in RT-Thread up to 5.0.2. Affected by this vulnerability is the function recvmsg in the library bsp/loongson/ls1cdev/libraries/ls1c_can.h of the component ls1c CAN Handler. Such manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-14606] A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function…

A security flaw has been discovered in RT-Thread up to 5.0.2. Affected by this issue is the function CAN_Receive in the library bsp/synwit/libraries/SWM341_CSL/CMSIS/DeviceSupport/SWM341.h of the component SWM341 CAN Handler. Performing a manipulation results in stack-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be used for a…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58379] A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulner…

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an ov…

nvdaltovulnerabilidad CVSS 7.3 NVD