Alertas de Seguridad de la Información

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-64257] In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping…

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject overlapping data areas in SMB2 responses Commit 53b7c271f06b ("smb: client: restrict implied bcc[0] exemption to responses without data area") restricted the implied bcc[0] length exception to responses without a data area. However, the overlap handling in __smb2_calc_size() clears data_length, which can make…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/07/2026

[CVE-2026-16766] Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via P…

Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-16280] An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncatio…

An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-61884] The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side vali…

The web management interface of Tycon Systems TPDIN-Monitor-WEB2  does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid administrative session. This grants full access to device controls including power relay management, dev…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-62835] Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over …

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-48021] In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between ep…

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys. All inner HTTP traffic (patient consent decisions, medication data, document operations, authorization tokens, and entitlement queries) becomes readable and modifiable. The …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-64232] In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_s…

In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's unde…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-64216] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in net…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlo…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58630] Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges o…

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58586] Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does…

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the mo…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-57106] Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privil…

Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56163] Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unautho…

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-16634] TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The…

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 libra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-15704] In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln…

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-12877] The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti…

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-62825] Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges ove…

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58275] Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw…

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56191] Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp…

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56160] Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate pri…

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56165] Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over…

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD