Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-8071] The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize …

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-10846] NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolv…

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulne…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-11837] A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The…

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator ru…

nvdaltovulnerabilidad CVSS 7.3 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26239] A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gai…

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26237] A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can …

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24719] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24724] An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote att…

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24716] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66281] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-22893] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66273] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66279] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66280] An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating s…

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and …

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-62850] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 an…

nvdaltovulnerabilidad CVSS 7.2 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45542] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a…

nvdaltovulnerabilidad CVSS 7.1 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45329] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machi…

nvdaltovulnerabilidad CVSS 7.1 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45541] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53673] BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST AP…

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused b…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53674] BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention reso…

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP que…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46541] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsi…

nvdaltovulnerabilidad CVSS 7.5 NVD