Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56006] Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.

Unauthenticated Cross Site Scripting (XSS) in H5P

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56014] Unauthenticated Cross Site Scripting (XSS) in Master Slider <= 3.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Master Slider

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56042] Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56049] Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.

Contributor Remote Code Execution (RCE) in Post Snippets

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54848] Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for …

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56005] Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions.

Subscriber Cross Site Scripting (XSS) in WP Activity Log

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54841] Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

Unauthenticated Sensitive Data Exposure in Vitepos

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54842] Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configu…

Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54821] Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview

nvdaltovulnerabilidad CVSS 7.4 NVD

D Alto vulnerabilidad

25/06/2026

[CVE-2026-49506] Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathn…

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

25/06/2026

[CVE-2026-46733] Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Acces…

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

D Alto vulnerabilidad

25/06/2026

[CVE-2026-46734] Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certifica…

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Certificate Validation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53270] In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler p…

In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53272] In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sb…

In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchronously. Then, after all folios are unlocked, un…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53273] In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-f…

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 ("tee: optee: Fix supplicant wait loop") made the client wait as killable so it can be interrupted during shutdown or after a supplicant crash. This changes the original lifetime expectations: the client task can now terminate whil…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53275] In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free…

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a pointer to the multicast group address is retrieved when initially parsing the packet. This pointer is later dereferenced without being reloaded despite the fact that the skb header might have been reallocated following the pskb_may_pull(…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53276] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock * which shall not be acquired while holding sock_lock for proper * ordering. …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53277] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock …

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot changes. While this is generally the case, __kvm_at_s12() and __kvm_find_s1_desc_level() call into the respective walkers without taking k…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53262] In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference …

In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asyn…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53264] In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU wit…

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock()

nvdaltovulnerabilidad CVSS 7.8 NVD