Alertas de Seguridad de la Información

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46480] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace evaluator takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-46656] Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw wh…

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions remain valid even after the corresponding user account has been physically deleted from the database. This "Ghost Session" allows revoked users to maintain full unauthorized access to the system. Version 3.22.0 fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46444] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API ke…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46475] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace assistant takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46476] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-44185] Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker contr…

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-44186] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in …

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46274] In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecess…

In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46275] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs a…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if …

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-42536] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and…

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-42863] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side valid…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-34194] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause m…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of a mapping state maintained for a sparse memory allocation. The product accidentally refers to the wrong memory due to the semantics of how math operations are implicitly scaled across buffers of different sizes.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-34355] A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an …

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-34356] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and Pr…

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-36786] Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow i…

Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 parameter of the fromDhcpListClient function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11523] A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the…

A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management Interface. Executing a manipulation of the argument gotoUrl can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11524] A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRul…

A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11528] A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 …

A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of the component Web Management Interface. The manipulation of the argument callback results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-22164] Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt…

Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. By creating resources of certain types and presenting a set of parameters to the affected interface the exploit can be used to corrupt kernel memory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11522] A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSe…

A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD