Alertas de Seguridad de la Información

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64384] In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify …

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix change notify replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_notify_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale fr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64385] In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in…

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale f…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64386] In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() r…

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix query_info() replay double-free A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_query_info_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64355] In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames i…

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdp_frame data, while fragmented frames keep skb_shared_info in tailroom outside the linear area. Cloning such a frame leaves XDP_FLAGS_HAS_FRAGS set but wi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64319] In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply mess…

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (hash length) and dhvlen (DH value length) fields without verifying they fit within the allocated buffer of tl bytes. A malicious NVMe-oF initiator can craft a DHCHA…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64303] In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the R…

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengine_prep_slave_sg() fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was already submitted and issued prior to preparing the TX descriptor, returning -EINVAL causes the SPI …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64268] In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response p…

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. si…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-16766] Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P…

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-16280] An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncatio…

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-61884] The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side vali…

The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, dev…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-64232] In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s…

In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's unde…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-12877] The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti…

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-42933] Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit…

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-52439] An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.ne…

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15630] A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod…

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65700] h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that…

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15612] Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling repl…

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15617] Logto performs principal lookup without normalizing email and identifier strings, enabling principal…

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65461] Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

Administrator Arbitrary File Upload in Really Simple CSV Importer

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65455] Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

Administrator Arbitrary File Upload in MapSVG

nvdcriticovulnerabilidad CVSS 9.1 NVD