Alertas de Seguridad de la Información

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53405] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-12701] A path traversal vulnerability was found in pulpcore. The relative_path_validator function only veri…

A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative_path containing embedded traversal sequences (e.g., "looking/normal/../../../../etc/shadow") that escapes the intende…

nvdcriticovulnerabilidad CVSS 9.0 NVD

F Crítico vulnerabilidad

20/07/2026

[CVE-2026-64620] FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common…

FreeRDP before 3.28.0 (affected

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-16242] A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent…

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy,…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-16235] Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These ver…

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-13147] The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it…

The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts (Server-Side Request Forgery).

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-44359] Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtast…

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated GITHUB_TOKEN permissions. No approval gate exists. Pull requests from external users with author_ass…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64160] In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearin…

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in ->remote_i_size and ->zero_point Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size. We need to make sure that netfslib and the filesystems that use it always hold i_lock whilst updating any of …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64162] In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spi…

In the Linux kernel, the following vulnerability has been resolved: idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() In idpf_ptp_init(), read_dev_clk_lock is initialized after ptp_schedule_worker() had already been called (and after idpf_ptp_settime64() could reach the lock). The PTP aux worker fires immediately upon scheduling and can call into idpf_ptp_read_src_clk_reg_direct(), wh…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64142] In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against m_fp_list lookups ksmbd_durable_scavenger() has two related races against any walker that iterates f_ci->m_fp_list, including ksmbd_lookup_fd_inode() (used by ksmbd_vfs_rename) and the share-mode checks in fs/smb/server/smb_common.c. (1) fp->node list-head reuse. Durable-preserved h…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64150] In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release l…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: release local_lock before re-enabling softirqs Quoting sashiko: In the error path, local_bh_enable() is called before local_unlock_nested_bh().

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64132] In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer…

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Tra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64136] In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count i…

In the Linux kernel, the following vulnerability has been resolved: smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() Commit 96c4af418586 ("cifs: Fix locking usage for tcon fields") refactored cifs code to change cifs_tcp_ses_lock for tc_lock around tc_count changes. There was missing lock around tc_count increment inside smb2_find_smb_sess_tcon_unlocked().

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64125] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: keep RBUF EEE/PM disabled Setting RBUF_EEE_EN | RBUF_PM_EN in RBUF_ENERGY_CTRL breaks the RX path on GENET hardware once MAC EEE becomes active. RX traffic stops flowing while the link stays up and the usual descriptor/RX error counters remain quiet. In that state the MAC still accepts frames (rbuf_ovflow_cnt keep…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64122] In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free i…

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown. …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64113] In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in …

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64102] In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU lengt…

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64106] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject re…

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range num_eventid_bits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that state, but vgic_its_restore_dte() accepts it and stores the out-of-range value in dev->num_eventid…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64089] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative la…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative last_changeset_len batadv_piv_tt::last_changeset_len len was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. In batadv_send_my_tt_response(), last_changeset_len is temporarily widened to s3…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

19/07/2026

[CVE-2026-64091] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated. Only then, the list of VLANs s used to fill the VLAN entries in the buffer. During this time, the mesh…

nvdcriticovulnerabilidad CVSS 9.8 NVD