Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-56852] A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-46600] Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the messa…

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47667] CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the…

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any m…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-15957] Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers fr…

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stac…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16493] A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's conc…

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command e…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-44907] A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to s…

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-15792] A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon cra…

A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-15724] In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated …

In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on the server.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-64824] Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore fu…

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assis…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65052] Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerab…

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, cau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-8933] A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component…

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or secur…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-15226] A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution e…

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16447] A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16445] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to comman…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16384] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16385] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16386] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16376] Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and…

Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-1771] The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val…

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-8082] The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter bef…

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.

nvdaltovulnerabilidad CVSS 7.5 NVD