Alertas de Seguridad de la Información

T Alto vulnerabilidad

05/06/2026

[CVE-2026-45743] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can read, write, delete, download, and execute files on the vic…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45327] TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent…

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcry…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45290] Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v…

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260417.085727-30` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a vulnerability in Network to stall the netty event loop, rendering it inoperable. All consumers of the library should upgrade to at le…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45291] Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v…

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260418.124334-32` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least ve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-36501] An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to ca…

An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11342] A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affec…

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11344] A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown fu…

A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD

7 Alto vulnerabilidad

05/06/2026

[CVE-2026-48095] 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buff…

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11334] A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec8…

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Conti…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50231] Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to exe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50232] Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50234] Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack…

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

nvdaltovulnerabilidad CVSS 7.5 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50264] An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuff…

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50258] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has mu…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may…

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50259] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() …

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50260] A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that s…

A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50261] A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client …

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50256] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between …

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to c…

nvdaltovulnerabilidad CVSS 7.8 NVD

X Alto vulnerabilidad

05/06/2026

[CVE-2026-50257] A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client…

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privileg…

nvdaltovulnerabilidad CVSS 7.8 NVD