Alertas de Seguridad de la Información

C Alto vulnerabilidad

09/06/2026

[CVE-2026-20245] Vulnerabilidad explotada activamente en Cisco Catalyst SD-WAN Manager

CISA confirma explotación activa de una vulnerabilidad en Cisco Catalyst SD-WAN Manager. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-23.

ciscoexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

08/06/2026

[CVE-2026-49141] WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine…

WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modif…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-40519] Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticate…

Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dns_provider_credentials field. The user-controlled dns…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11582] A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is…

A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

08/06/2026

[CVE-2026-46490] samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template su…

samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., ) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new elements inside the signed assertion. The IdP then signs the tampe…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11557] A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function f…

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11556] A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWrit…

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11553] A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function form…

A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation of the argument encodename results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-46481] OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigg…

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked i…

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46311] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c0…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46304] In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq…

In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() runs on nvmet-wq and can drop the final controller reference through nvmet_cq_put(). If that triggers nvmet_ctrl_free(), the teardown path flushes ctrl->async_event_work on the same nvmet-wq. Call chain: nvmet_tcp_schedule_release_queue() …

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46306] In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect …

In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow dissector driver has assumed an uncompressed frame until the blamed commit. During the review process o…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46307] In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access arra…

In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an array-index-out-of-bounds access as > shown by the UBSAN kernel message: > UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath5k/base.c:1741:20 > index 4 is out of range for type 'ieee80211_tx_rate [4]' > ... > Call Trace: >

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46308] In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-aft…

In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_get_bus_protection_legacy(), of_find_node_with_property() returns a device node with its reference count incremented. The function then calls of_node_put(node) before checking whether syscon_regmap_lookup_by_phandle() returns an error. If an e…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46309] In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PA…

In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in xe_vm_madvise_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when applied to CPU cached memory. Using coh_none with CPU cached buffers is a security issue. When the kernel clears pages before reallocation, the clear operatio…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46299] In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on…

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then free…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46301] In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-afte…

In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its queue before releasing the DMA buffers on driver unbind

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46303] In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE c…

In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added c…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46293] In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix o…

In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix out of bounds access during output registration UBSAN reported an out of bounds access during registration of the last two outputs. This out of bounds access occurs because space is only allocated in the hws array for two PLLs and the four output dividers that each has, but the defined IDs contain t…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46294] In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in io…

In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next …

nvdaltovulnerabilidad CVSS 7.8 NVD