Alertas de Seguridad de la Información

A Crítico vulnerabilidad

24/06/2026

[CVE-2026-55455] Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outb…

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive address-class check (loopback, any-local, link-local, fc00::/7) exists only on a separate code path used by SMTP, not by the…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-55570] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape th…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted and the value is produced with JSON.stringify() (which does not escape ', ), a package whose name contains a singl…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-54067] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body cont…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, CSS snippet body containing breaks out of its surrounding tag when renderSnippet() interpolates it via insertAdjacentHTML. A payload like runs arbitrary JavaScript in the renderer. On Electron desktop builds the renderer runs with nodeIntegration:true, so require('child_process') is reachable from the i…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-54158] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (d…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the attribute-view (database) cell renderer genAVValueHTML interpolates cell content raw in four of its branches: text, url, phone, and mAsset. A cell value like or "> breaks out of its surrounding tag and runs arbitrary JavaScript in the renderer when the vi…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-50551] SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a sto…

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan contains a stored cross-site scripting (XSS) vulnerability in the Attribute View (database) asset cell renderer that escalates to remote code execution (RCE) in the Electron desktop client. This vulnerability is fixed in 3.7.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

C Crítico vulnerabilidad

24/06/2026

[CVE-2026-39893] Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, th…

Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request variable was concatenated into a RLIKE SQL clause without sanitization. The endpoint does not require authentication (graph viewing supports guest access via the configured guest user), so the SQLi was reachable pre-auth on installs with guest viewing enabled. This issue was fixed …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-52813] Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path …

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the oth…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-52806] Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to …

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45688] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rocket.Chat's CAS login handler forwards the client-supplied options.cas.credentialToken value straight into a MongoDB findOne({_id: ...}) query without any runtime type check. TypeScript's string parameter annotation is erased at runtime, so an…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-45689] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, an unauthenticated network attacker obtains a valid Rocket.Chat OAuth access token for an arbitrary user by sending a single HTTP POST with MongoDB query operators to /oauth/token. The Rocket.Chat OAuth2 server does not validate that grant param…

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Crítico vulnerabilidad

24/06/2026

[CVE-2026-49980] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute l…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-53943] Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared cach…

Ghost is a Node.js content management system. From until 6.37.0, when Ghost is behind a shared caching layer that results in cached content being shared between different visitors, an unauthenticated user could send an x-ghost-preview header that altered the rendered frontend response. In affected cache configurations, that response could be stored and served to subsequent visitors requesting the…

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

24/06/2026

[CVE-2026-13028] Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacke…

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

24/06/2026

[CVE-2026-13032] Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacke…

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

R Crítico vulnerabilidad

24/06/2026

[CVE-2026-54906] concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#re…

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired the write lock. Any thread with access to the lock object can release an active write lock held by another thread. A second writer can then enter its critical section while the first writer is still running. Concurrent::ReadWriteLock#…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53086] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53088] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one i…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix off-by-one in bcmgenet_put_txcb The write_ptr points to the next open tx_cb. We want to return the tx_cb that gets rewinded, so we must rewind the pointer first then return the tx_cb that it points to. That way the txcb can be correctly cleaned up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53055] In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - preven…

In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec2 - prevent req used-after-free for sec During packet transmission, if the system is under heavy load, the hardware might complete processing the packet and free the request memory (req) before the transmission function finishes. If the software subsequently accesses this req, a use-after-free error will occ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53043] In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregio…

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch …

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53045] In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_c…

In the Linux kernel, the following vulnerability has been resolved: memory: tegra124-emc: Fix dll_change check The code checking whether the specified memory timing enables DLL in the EMRS register was reversed. DLL is enabled if bit A0 is low. Fix the check.

nvdcriticovulnerabilidad CVSS 9.8 NVD