Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12217] A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown f…

A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12214] A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the …

A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring Logic. Performing a manipulation of the argument NetworkAddr results in protection mechanism failure. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12204] A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderC…

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The v…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12200] A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impac…

A security vulnerability has been detected in Ritlabs TinyWeb Server up to 1.94 on Win32. This impacts an unknown function in the library libeay32.dll.html of the component Header Handler. The manipulation of the argument Authorization leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12192] A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component…

A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This manipulation causes buffer overflow. The attack is only possible within the local network. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12193] A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the f…

A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handler in the library RevoDetector.sys of the component IOCTL Handler. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version 2.7.0 is sufficient to fix this issue. It is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12197] A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function n…

A security flaw has been discovered in Ruijie EG105G-P 2.340. The impacted element is the function nslookup of the file /cgi-bin/luci/api/diagnose of the component JSON-RPC Diagnose Endpoint. Performing a manipulation of the argument params.target results in command injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. T…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12198] A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path …

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor w…

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

15/06/2026

[CVE-2026-54420] Vulnerabilidad explotada activamente en LiteSpeed cPanel Plugin

CISA confirma explotación activa de una vulnerabilidad en LiteSpeed cPanel Plugin. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-18.

litespeedexplotación activavulnerabilidad CISA KEV

C Alto vulnerabilidad

15/06/2026

[CVE-2026-20262] Vulnerabilidad explotada activamente en Cisco Catalyst SD-WAN Manager

CISA confirma explotación activa de una vulnerabilidad en Cisco Catalyst SD-WAN Manager. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-29.

ciscoexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12187] A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulner…

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknown functionality of the file /usr/bin/one_click_upgrade of the component Online Firmware Upgrade Handler. Such manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 4.7 addresses …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-12186] A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_co…

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library /usr/lib/oui-httpd/rpc/tor of the component Tor Proxy Service Configuration Handler. This manipulation causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 4.7 is abl…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-54410] nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function …

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header() function of the Modbus/TCP server that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of the 260-byte receive buffer by sending a crafted MBAP frame whose Length field is set to 255. The overflow corrupts the adjacent buffer-index field of the nanoMODBUS state stru…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-54413] driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read i…

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads …

nvdaltovulnerabilidad CVSS 8.2 NVD

D Alto vulnerabilidad

13/06/2026

[CVE-2026-12174] A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the functi…

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-6428] SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before…

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-5513] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user ac…

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

13/06/2026

[CVE-2026-11769] We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity secur…

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-54228] A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetEl…

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6676] Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed PO…

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.

nvdaltovulnerabilidad CVSS 7.8 NVD