Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92719] Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file …

Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92398] A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unk…

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this issue is some unknown functionality of the file /etc/rg_config/admin of the component user_list_note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-92397] A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerabilit…

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-88064] Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until…

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-node package insufficiently validates mkdocs.yml supplied by an authenticated user who can register or modify a TechDocs source. Unsafe Python YAML tags, markdown_extensions names and configuration, theme options, and extra_templates values can reach the docum…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-84858] ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via S…

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privile…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-84860] ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security g…

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-84997] react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.…

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos retur…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92362] A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the fi…

A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92136] Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-C…

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92137] Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configure…

Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content, which can lead to remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-90042] In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filename…

In the Linux kernel, the following vulnerability has been resolved: ceph: properly decrypt filenames in vmalloc() buffers The fscrypt subsystem uses the scatterlist crypto API, inheriting its requirement that any buffers are in the linear mapping region. However, the messenger client uses kvmalloc() to create buffers for messages, which will occasionally place those buffers in the vmalloc() regi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90045] In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifeti…

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: ffs: fix mm lifetime handling io_data stores a pointer to the submitting task's mm_struct, but does not currently hold a reference to it while async requests are pending. This can result in a use-after-free if the task exits before completion handling finishes. Take a reference with mmgrab() when queuing the read …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90030] In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when i…

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: clear forceRM when issuing EndTransfer The forceRM bit of the DEPCMD register controls the behavior of the EndTransfer command used to stop an active transfer. Older DWC3 programming guide revisions recommended setting forceRM=1 when issuing EndTransfer. Newer programming guide revisions recommend issuing EndTransfer …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-90008] In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe …

In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus one per page of the buffer for the chain pointer. The loop runs until the transfer…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89992] In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree()…

In the Linux kernel, the following vulnerability has been resolved: cpuidle: dt_idle_genpd: kfree() the original name allocation dt_idle_pd_alloc() kasprintf()s the full node path, then points pd->name at kbasename() of that string. dt_idle_pd_free() kfree()s pd->name, which is no longer the start of the allocation. Copy the basename instead.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89974] In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fab…

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvmf_create_ctrl() owns the fabrics options and frees them whenever ->create_ctrl() returns an error, so a transport must not free them on its own error paths. nvme-fc tracks this by testing ctrl->ctrl.opts in nvme_fc_ctrl_free(), which requires nvme_fc_init…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89960] In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqap_ho…

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() In vfio_ap_mdev_set_kvm(), kvm->arch.crypto.pqap_hook is set to &matrix_mdev->pqap_hook before the update locks are acquired and the mdev list is checked for a conflicting assignment. If another mdev is already attached to the same KVM instance, the fun…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89922] In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when impor…

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Take srcu when importing watchpoint data __import_wp_info() backs up the original guest memory contents of a watchpoint with read_guest_abs(), which is kvm_read_guest() and therefore resolves the memslot via __kvm_memslots(). That requires kvm->srcu (or kvm->slots_lock) to be held, otherwise a concurrent memslot updat…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-89914] In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for …

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Sign-extend VA for range-based TLBI invalidation When the decode_range_tlbi() helper was moved to be used for S1 TLBIs, the required sign extension was omitted. Add it. As a result, special care must be taken to not overflow PA bits when this is used for S2 invalidation.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-89875] In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflo…

In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDMA list private pointer. Both keep touching stream, port and device state; the recovery worker also re…

nvdaltovulnerabilidad CVSS 7.8 NVD