Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42670] Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservati…

Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42685] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal allows Reflected XSS. This issue affects WP Job Portal: from n/a through 2.5.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-53440] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion. This issue affects Confidant: from n/a through 1.4.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-58024] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-58705] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion. This issue affects Crafti: from n/a through 1.12.

nvdaltovulnerabilidad CVSS 8.1 NVD

J Alto vulnerabilidad

02/06/2026

[CVE-2026-5422] A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root dire…

A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-53345] Missing Authorization vulnerability leading to code execution after installing malicious vulnerable …

Missing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Core: from n/a through 2.3.3.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-52759] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This issue affects Accordion FAQ: from n/a through 2.2.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-3514] In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the imp…

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without aut…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

02/06/2026

[CVE-2026-1784] The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through H…

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-8293] The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor chal…

The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowing an attacker who knows a user's password to obtain a WordPress authentication session for that user without completing the email OTP challenge.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/06/2026

[CVE-2026-38950] An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted mode…

An issue in ESA AnomalyMatch before 1.3.1 allow attackers to execute arbitrary code via crafted model checkpoint files. The affected components load model files from session directories using torch.load() with unrestricted deserialization.

check-pointcheckpointalto CVSS 7.8 NVD

C Alto vulnerabilidad

28/05/2026

[CVE-2026-46175] In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency ca…

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix fsck inconsistency caused by FGGC of node block During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data. The reproduction scenario: root@vm:/mnt/f2fs# seq 1 2048 | xargs -n 1 ./test_sync // write inline inode and sync root@vm:/mnt/f2fs# rm -f 1 root@vm:/mnt/f2fs# sync…

check-pointcheckpointalto CVSS 7.1 NVD

C Alto vulnerabilidad

12/05/2026

[CVE-2026-31221] PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-…

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoint loading mechanism. The LightningModule.load_from_checkpoint() method, which is commonly used to load saved model states, internally calls torch.load() without setting the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbi…

check-pointcheckpointalto CVSS 7.8 NVD

C Alto vulnerabilidad

12/05/2026

[CVE-2026-31222] The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the…

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() method of the Trainer class. The method loads model checkpoint files using torch.load() without enabling the security-restrictive weights_only=True parameter. This default behavior allows the deserialization of arbitrary Python objects via the Pickle module. A remote attacker can exp…

check-pointcheckpointalto CVSS 8.8 NVD

C Alto vulnerabilidad

11/05/2026

[CVE-2026-31253] The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13…

The flash-attention training framework thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains an insecure deserialization vulnerability (CWE-502) in its checkpoint loading mechanism. The load_checkpoint() function in checkpoint.py and the checkpoint loading code in eval.py use torch.load() without enabling the security-restrictive weights_only=True parameter. This allows the de…

check-pointcheckpointalto CVSS 7.3 NVD

C Alto vulnerabilidad

11/05/2026

[CVE-2026-31250] CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure des…

CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its average_model.py model averaging tool. The script loads PyTorch checkpoint files (epoch_*.pt) for model averaging using torch.load() without enabling the weights_only=True security parameter. This allows the deserialization of arbitrary Python objects via …

check-pointcheckpointalto CVSS 7.3 NVD