Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74745] In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when …

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock. Move the restart to the async service task. T…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74747] In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent…

In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access. One such place reported by Sashiko is ip_vs_nat_icmp() where local process can change t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74748] In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount …

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleav…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74736] In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-…

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_bpf: reject dev-bound programs bound to a different device cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifinde…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74739] In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash t…

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74741] In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer der…

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INTR_MISC(wx) dereferences wx->msix_entry->entry, leading to a NULL pointer dereference crash. This issue was introduced by fixing the IRQ ve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74742] In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to w…

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-54550] IzPack is a widely used tool for packaging applications on the Java platform as cross-platform insta…

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without n…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-54511] LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog p…

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. When includeStructuredData …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-75960] Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credential…

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-73108] RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability i…

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connectio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-18252] GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 bef…

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19271] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i…

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-15990] The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up t…

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Cha…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77658] A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network…

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attribute_num_data() without validating an upper bound: bus->num_handles = attribute_num_data(attr); When a bus handle is subsequently move…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-15985] The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentica…

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by subm…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80205] NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.fin…

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80350] OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a sma…

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 rang…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80346] StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every …

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializ…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80347] mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround a…

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://[::1]/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a bracketed value, so the branch holding the private-address checks is skipped entirely. The guard fall…

nvdaltovulnerabilidad CVSS 7.5 NVD