Alertas de Seguridad de la Información

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52931] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tp_meter: avoid use of uninit sender vars batadv_tp_recv_ack() and batadv_tp_stop() are only valid for tp_vars in the BATADV_TP_SENDER role. When called with a BATADV_TP_RECEIVER role, it proceeds to read sender-only members that were never initialized, leading to undefined behavior. This can be triggered when a nod…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52924] In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale C…

In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless …

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-52914] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reasse…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix fragment reassembly length accounting batman-adv keeps a running payload length for queued fragments and uses it to validate a fragment chain before reassembly. That accounting currently allows the accumulated fragment length to be truncated during updates. As a result, malformed fragment chains can bypass the i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12416] The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in a…

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parame…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12417] The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Re…

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12850] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12851] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12486] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12846] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12847] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12848] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12849] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12485] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/06/2026

[CVE-2026-54588] Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4…

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to re…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

23/06/2026

[CVE-2026-11807] A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The…

A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messages. Any authenticated user can send a forged message with an arbitrary activation_id to receive plaintext credentials associated with that activation, including OAuth tokens, vault passwords, and SSH…

nvdcriticovulnerabilidad CVSS 9.6 NVD

T Crítico vulnerabilidad

23/06/2026

[CVE-2026-48491] Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity…

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientC…

nvdcriticovulnerabilidad CVSS 10.0 NVD

T Crítico vulnerabilidad

23/06/2026

[CVE-2026-53622] Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerabilit…

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which…

nvdcriticovulnerabilidad CVSS 10.0 NVD

T Crítico vulnerabilidad

23/06/2026

[CVE-2026-48020] Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a …

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encode…

nvdcriticovulnerabilidad CVSS 10.0 NVD

K Crítico vulnerabilidad

23/06/2026

[CVE-2026-53753] Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expres…

Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

23/06/2026

[CVE-2026-54316] Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.…

Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without a permission prompt or being subject to --allowedTools restrictions. An attacker able to inject untrusted content into a Claude Code contex…

nvdcriticovulnerabilidad CVSS 9.1 NVD