Alertas de Seguridad de la Información

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52917] In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associ…

In the Linux kernel, the following vulnerability has been resolved: sctp: diag: reject stale associations in dump_one path The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list. When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill()…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52918] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q a…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: serialize accept_q access bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and pollin…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52919] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counte…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending"…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52920] In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix stric…

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume info->pol[] in the same forward order as the rule layout. Derive the strict-match policy position from the number of transforms already cons…

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52912] In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridg…

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjectio…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9709] The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST …

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone W…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9710] The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-p…

The Cornerstone WordPress plugin before 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, and exposes the nonce needed to call it to every logged-in user on any wp-admin page, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata including raw password hashes. This affects the premium co C…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9178] The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up…

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a '…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-4297] The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in al…

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authori…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12416] The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in a…

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parame…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12417] The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Re…

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10092] The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12850] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12851] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12486] Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVisio…

Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network packet can lead to command execution. An attacker can send a network request to trigger this vulnerability. `libNetSetObj.so` is an internal library used by various binaries on the device to configure the network stack (start and stop various servi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12846] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12847] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12848] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

nvdcriticovulnerabilidad CVSS 10.0 NVD