Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/07/2026

[CVE-2026-65603] The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in …

The Grav Login plugin (grav-plugin-login) versions

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49477] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beau…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49476] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a re…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

06/07/2026

[CVE-2026-44937] Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.1…

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by remote attackers to cause a denial of service or a downgrade attack on other repositories on the system.

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

02/07/2026

[CVE-2026-44941] A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 c…

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

nvdaltovulnerabilidad CVSS 8.4 NVD

S Alto vulnerabilidad

30/06/2026

[CVE-2026-44946] A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler di…

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

nvdaltovulnerabilidad CVSS 7.4 NVD

S Alto vulnerabilidad

30/06/2026

[CVE-2026-41053] Incorrect authentication caching in the team member ship expansion of the Rancher Github authenticat…

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-41052] Improper privilege handling could be used by users with Project Owner role to escalate privileges, i…

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

29/06/2026

[CVE-2026-25707] A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10…

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53159] In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address …

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix DMA address corruption due to find_vma misuse fastrpc_get_args() uses find_vma() to look up the VMA for a user-provided pointer and compute a DMA address offset. When the address falls in a gap before the returned VMA, (ptr & PAGE_MASK) - vma->vm_start underflows, corrupting the DMA address sent to the DSP. R…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

23/06/2026

[CVE-2026-45135] Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCG…

Caddy is an extensible server platform that uses TLS by default. From 2.7.0 until 2.11.3, the FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead Caddy's FastCGI splitting into treating a non-.php (or ot…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2025-71261] An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE H…

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45062] FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the…

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can plac…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49187] The hard-coded APK resource files never expire, and the shared scepter leads to information leaks an…

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

nvdaltovulnerabilidad CVSS 7.5 NVD