Alertas de Seguridad de la Información

S Crítico vulnerabilidad

25/06/2026

[CVE-2026-54917] SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables.…

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, obj…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54089] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credenti…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50548] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50549] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the…

nvdcriticovulnerabilidad CVSS 9.8 NVD

W Crítico vulnerabilidad

25/06/2026

[CVE-2026-6094] Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This …

Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing crafted PKCS7 EnvelopedData. This could theoretically be triggered by attacker-supplied data delivered via S/MIME or CMS.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54849] Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.

Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54843] Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.

Unauthenticated SQL Injection in MDTF

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54836] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54823] Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

Contributor Remote Code Execution (RCE) in Widget Options

nvdcriticovulnerabilidad CVSS 9.9 NVD

D Crítico vulnerabilidad

25/06/2026

[CVE-2026-41120] Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untru…

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53260] In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enabl…

In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53246] In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached IN…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53247] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU rea…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53224] In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT ch…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncate…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53225] In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sct…

In the Linux kernel, the following vulnerability has been resolved: sctp: fix uninit-value in __sctp_rcv_asconf_lookup() __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated p…

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53228] In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 he…

In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6_tunnel_xmit() caches the inner IPv6 header pointer at function entry and continues using it after iptunnel_handle_offloads(). For GSO skbs, iptunnel_handle_offloads() calls skb_header_unclone(). When the skb header is cloned, skb_header_unclone() can call pskb_expand_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53215] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers b…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: refill RX buffers before XDP or skb use The RX error path returns the current descriptor buffer to the hardware BM pool. That is only valid while the driver still owns the buffer. mvpp2_rx_refill() can fail after the current buffer has been handed to XDP or attached to an skb. In those cases mvpp2_run_xdp() may have…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53216] In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame siz…

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: limit XDP frame size to the RX buffer mvpp2 has short and long BM pools, and short pool buffers can be smaller than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with PAGE_SIZE as frame size. XDP helpers use frame_sz to validate tail growth and to derive the hard end of the data area. Advertising P…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53221] In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel m…

In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() In vti6_tnl_lookup(), when an exact match for a tunnel fails, the code falls back to searching for wildcard tunnels: - Tunnels matching the packet's local address, with any remote address wildcard remote). - Tunnels matching the packet's remote address, with any loc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53186] In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense c…

In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: bound SRP_RSP sense copy by the received length srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSI…

nvdcriticovulnerabilidad CVSS 9.1 NVD