Alertas de Seguridad de la Información

M Crítico vulnerabilidad

27/08/2026

[CVE-2026-47884] Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has…

Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and ea…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-70419] Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special…

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-81032] NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon star…

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics. Neither the service nor its router carries any authentication, token check or address restriction. The read…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80428] ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel en…

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shib_logout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to terminate by reading every live row of the session table and passing each row's stored data to a hand-wr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-54569] SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.…

SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authorization and unsafe evaluation. The state-changing routes in src/bika/lims/jsonapi/update.py, including update, update_many, remove, doActionFor, doActionFor_many,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80587] In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some inc…

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictio…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80589] In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer w…

In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk disk_release() undoes blk_mq_init_allocated_queue() for a disk whose probe failed before add_disk(), but it only calls blk_mq_exit_queue(). Nothing there stops q->timeout, and that timer rolls forward: it stays pending until it next expires, not until the last reque…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80585] In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTF…

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SY…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80586] In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS field…

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the f…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80561] In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe de…

In the Linux kernel, the following vulnerability has been resolved: libceph: fix multiple unsafe decodes in decode_locker() decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80557] In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode…

In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via missing bounds check ceph_start_decoding() validates that struct_len bytes remain in the buffer after the encoding header, but accepts struct_len=0 as valid: ceph_decode_need(p, end, 0, bad) always passes. When a malicious or compromised OSD sends an obj_list_watch_response_t reply …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80558] In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid os…

In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80551] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDA…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consis…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80554] In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Limit the number of channel program segments The processing of channel programs, and the CCWs within them, is done recursively. As such, there is an arbitrary (but not architectural) limit to the number of CCWs that can exist in a single channel program. The vfio-ccw logic breaks these channel programs into segme…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80528] In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while us…

In the Linux kernel, the following vulnerability has been resolved: ceph: avoid fs reclaim while using current->journal_info handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-80519] In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cl…

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration and module removal make progress. Do not release that peer reference before the callback has finished…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74751] In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen rea…

In the Linux kernel, the following vulnerability has been resolved: riscv: lib: Fix ZBB strnlen reading past count boundary The ZBB-optimized strnlen loop loads one word ahead before checking the aligned boundary: REG_L t1, SZREG(t0) // load next word addi t0, t0, SZREG // advance orc.b t1, t1 bgeu t0, t4, 4f // boundary check AFTER load where t4 …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74752] In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH stat…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the loca…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74743] In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroo…

In the Linux kernel, the following vulnerability has been resolved: macvlan: inherit needed_headroom and needed_tailroom from lowerdev macvlan devices inherit hard_header_len from lowerdev during macvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying lowerdev requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74744] In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom…

In the Linux kernel, the following vulnerability has been resolved: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wi…

nvdcriticovulnerabilidad CVSS 9.8 NVD