Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49959] Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows auth…

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

09/06/2026

[CVE-2026-49847] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, a single unauthenticated WebSocket frame containing a deeply nested JSON document crashes the FreeSWITCH process via stack overflow, terminating all calls and sessions on the host. The recursi…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

09/06/2026

[CVE-2026-49840] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48575] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48568] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48570] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47656] Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a secur…

Protection mechanism failure in Windows Boot Manager allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-46492] md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cr…

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45656] Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feat…

Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45635] Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) …

Access of resource using incompatible type ('type confusion') in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45598] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45599] Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code…

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45601] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45603] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45592] Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to el…

Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45597] Concurrent execution using shared resource with improper synchronization ('race condition') in UI Au…

Concurrent execution using shared resource with improper synchronization ('race condition') in UI Automation Manager (uiamanager.dll) allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45588] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44818] Concurrent execution using shared resource with improper synchronization ('race condition') in Micro…

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

O Alto vulnerabilidad

09/06/2026

[CVE-2026-45445] Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-sho…

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same cod…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-42991] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD