Alertas de Seguridad de la Información

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-63766] GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where AS…

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-44231] RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6…

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credenti…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-64193] Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. N…

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-39878] Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the …

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35048] The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configurati…

The Piwigo installer in versions 16.3.0 and earlier accepts POST parameters for database configuration and writes them directly into a PHP configuration file without proper sanitization. On PHP 8+, the `addslashes()` protection is bypassed because it checks for `get_magic_quotes_gpc()`, a function removed in PHP 8.0. This allows raw user input to be interpolated directly into PHP source code. An u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-46412] @beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with Op…

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of `@beproduct/nestjs-auth` (0.1.2 through 0.1.19). The postinstall payload attempted to harvest npm tokens (from `~/.npmrc`); GitHub personal access t…

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-63071] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-57308] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are r…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-62183] Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow …

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53421] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53405] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-12701] A path traversal vulnerability was found in pulpcore. The relative_path_validator function only veri…

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intende…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64162] In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spi…

In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), wh…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64132] In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer…

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Tra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64113] In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in …

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64056] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmac_rx() is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device is using both. Make the RX SKB a per-port variable and carry it over between invocations in the p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64033] In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sys…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64035] In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD…

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igc_fpe_init_smd_frame() initializes igc_tx_buffer fields for an SMD skb, but does not set the buffer type: https://sashiko.dev/#/patchset/20260415025226.114115-1-kohei%40enjuk.jp Since igc_tx_buffer entries are reused, a stale XDP or XSK type can remain and make T…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64025] In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data…

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-63994] In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers a…

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr() before an skb_cow() call which can reallocate skb->head. Fix this possible UAF by initializing the local variables after the skb_c…

nvdcriticovulnerabilidad CVSS 9.8 NVD