Alertas de Seguridad de la Información

P Alto vulnerabilidad

08/07/2026

[CVE-2026-10698] Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Tra…

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-10699] Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom…

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: from 2025.0.0 before 2025.0.8, from 2025.1.0 before 2025.1.4, from 2026.0.0 before 2026.0.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-11903] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

nvdaltovulnerabilidad CVSS 8.0 NVD

L Alto vulnerabilidad

04/07/2026

[CVE-2026-53361] In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to …

In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() …

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

02/07/2026

[CVE-2026-8079] In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenti…

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration.

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

02/07/2026

[CVE-2026-9272] In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adver…

In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-13369] The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the att…

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalizat…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53046] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbd_crypt_message() sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the Qualcomm Crypto Engine (QCE). When QCE returns -EINPROGRESS, ksmbd treats it as an error and imm…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52935] In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an…

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46311] In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to…

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap the wptr_obj while a queue creation is in progress and passing other bo at same address. (cherry picked from commit 1fc6c8ab45dbee096469c0…

nvdaltovulnerabilidad CVSS 7.8 NVD

P Crítico vulnerabilidad

04/06/2026

[CVE-2026-8037] OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an u…

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints

nvdcriticovulnerabilidad CVSS 9.6 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7195] CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4…

CWE-20: Improper Input Validation in web services in Progress Sitefinity 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote unauthenticated attacker to compromise the integrity and confidentiality of user accounts. Successful exploitation requires user intera…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Crítico vulnerabilidad

02/06/2026

[CVE-2026-7198] CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 a…

CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7201] CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.…

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privile…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Crítico vulnerabilidad

02/06/2026

[CVE-2026-7312] CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14…

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

P Alto vulnerabilidad

02/06/2026

[CVE-2026-7313] CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.…

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with Sitefinity Insight, non-default site configuration and valid back-end authorization.

nvdaltovulnerabilidad CVSS 8.7 NVD