Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63922] In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after…

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can move the skb head and invalidate the cached network header pointer. Refresh nh after ipv6_dest_hao() returns so any trailing pa…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63924] In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh point…

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63912] In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined sin…

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in esp_output_head() before esp_output_tail() allocates the destination page frag. The head-side gate currently checks skb->data_len and tailen separately, but the tail code allocates a single destination frag from the combined…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63886] In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate C…

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passes chap_r directly to chap_base64_decode() without checking whether the input length could produce more than digest_size bytes of output. c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63887] In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscs…

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf iscsi_encode_text_output() concatenates "key=value\0" records into login->rsp_buf, an 8192-byte kzalloc(MAX_KEY_VALUE_PAIRS) buffer allocated in iscsit_alloc_login_setup_buffer(). The three sprintf() call sites in this function (lines 1398, 1411, 1424 in v7…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63888] In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC ov…

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() Two latent bugs in the Text-phase handler, both present since the original LIO integration in commit e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1"): 1) DataDigest CRC buffer overread (4 bytes past text_in). text_in is …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63857] In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninit…

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63830] In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy ac…

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63825] In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter update…

In the Linux kernel, the following vulnerability has been resolved: gcov: use atomic counter updates to fix concurrent access crashes GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflate_fast(), the inner copy loops get transformed so that the GCOV counter value is loaded multiple times to compute the loop base address, start i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63808] In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-…

In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential use-after-free in exfat_find_dir_entry() In exfat_find_dir_entry(), the buffer_head obtained from exfat_get_dentry() is released with brelse(bh) before the fall-through TYPE_EXTEND branch reads the directory entry through ep (which points into bh->b_data): brelse(bh); if (entry_type == TYPE_EXTEND) { ..…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/07/2026

[CVE-2026-47865] VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with netw…

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-55518] Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51,…

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run the same authorization check before mutating the association through Avo::AssociationsCont…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-52348] cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-54159] PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4…

PrestaShop ps_facetedsearch is a module that adds layered navigation filters. From 3.0.0 until 4.0.4, the ps_facetedsearch module rebuilds selected search filters from the request URL, and the value of a slider filter, price or weight, is taken from the URL without sufficient validation and stored in an internal filter-block cache where it is serialized and later read back with a raw native unseri…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-48062] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-52199] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-36669] An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.…

An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload malicious files (such as .html) to the web-accessible /tmp/ directory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-42168] django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fi…

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2025-51677] An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the…

An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the netlist of the or1200 cpu output port can lead to unexpected behavior.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-8297] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management System allows SQL Injection. This issue affects GisLab Laboratory Management System: from 1.4.03 through 08072026.

nvdcriticovulnerabilidad CVSS 9.8 NVD