Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57878] An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC201…

An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing web request parameters in a specific request path. A remote attacker may exploit this vulnerability by sending a crafted HTTP request with overly long input, resulting in memory corruption…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57879] An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 …

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker may exploit this vulnerability by sending a crafted RTSP request, resulting in memory corruption, denial of service, or potentially arbitra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57880] An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 …

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending a crafted RTSP request containing overly long authentication data, resulting in memory corruption,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-40702] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate chargin…

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

nvdcriticovulnerabilidad CVSS 9.4 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71333] Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1…

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71336] Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote co…

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71338] Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoin…

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71327] Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register …

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

nvdcriticovulnerabilidad CVSS 9.1 NVD

W Crítico vulnerabilidad

25/06/2026

[CVE-2026-7531] Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-546…

Use-after-free in PQC hybrid key-share handling. This is an incomplete-fix follow-up to CVE-2026-5460 (released in 5.9.1): a malicious TLS 1.3 server sending a truncated PQC hybrid KeyShare can still trigger the error cleanup path to operate on freed memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

R Crítico vulnerabilidad

25/06/2026

[CVE-2026-56786] RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that …

RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in decode_type1033 function that fails to clamp length counters to destination buffer size, allowing up to 191-byte overflow into fixed 64-byte descriptor fields. An attacker controlling an NTRIP or serial RTCM3 correction stream can craft a valid CRC-bearing type-1033 message to corrupt adjacent rtcm_t object members, potentially …

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

25/06/2026

[CVE-2026-54917] SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables.…

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, obj…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54089] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credenti…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50548] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the working_directory parameter, which could cause the sandbox to include writable paths outside the intended workspace. A malicious agent could s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50549] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-54823] Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.

Contributor Remote Code Execution (RCE) in Widget Options

nvdcriticovulnerabilidad CVSS 9.9 NVD

D Crítico vulnerabilidad

25/06/2026

[CVE-2026-41120] Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untru…

Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code Execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53260] In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enabl…

In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53246] In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached IN…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53247] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU rea…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53224] In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT ch…

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded INIT chunk and address list lengths in cookie sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncate…

nvdcriticovulnerabilidad CVSS 9.1 NVD