Alertas de Seguridad de la Información

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-30141] An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function …

An issue was discovered in bitbank2 AnimatedGIF v2.2.0. A buffer overflow in the DecodeLZW function allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via a crafted GIF file.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-10045] Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121,…

Shenzhen Kangda Xin Intelligent Network Technology Company's router, model DR300, version 2.1.2.121, contains hardcoded login credentials and has telnet enabled by default on WAN and LAN interfaces. These vulnerabilities allow attackers to read and write to memory, modify firmware stored in flash, inspect active connections, and view currently connected devices.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2023-43688] An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a He…

An issue was discovered in Malwarebytes 4.x and 5.x (and Nebula 2020-10-21 and later). There is a Heap buffer overflow in various buffer encryption utilities.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2023-29146] The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash …

The utility functions used by Malwarebytes EDR 1.0.11 on Linux for calculating a cryptographic hash of data bytes truncate the hashed data if it exceeds 4GB. This leads to an integer wrap-around if the data is larger than the maximum unsigned integer value (32-bit). Attackers could create a colliding hash value for two different strings by attaching 4GB of data to a string that is less than 4GB in…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-50635] LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without…

LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it. The optional allowedHosts allowlist that would constrain this is undefined in the default (and documented) configuration, so LSHttpRequest::checkIsAllowedHost() results in no operation. A remote, unauthenticated attacker who submits a forgotten-password request for a known account (r…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-50636] The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied tok…

The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values directly into a tid IN ('...') SQL clause without parameterization or input validation. A remote, authenticated attacker holding the tokens/update permission on a survey can inject a crafted array element to perform SQL in…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49957] Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows …

Hermes WebUI before version 0.51.296 contains a workspace boundary bypass vulnerability that allows authenticated attackers to circumvent blocked-root path checks by exploiting an early return in the SSH/remote terminal profile workspace resolution logic within _remote_terminal_workspace_candidate(). Attackers can configure a remote terminal working directory to a system directory such as /etc, ca…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49959] Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows auth…

Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor during git status, protocol.ext.allow with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-46492] md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cr…

md-fileserver allows for local viewing of markdown files in a browser. Prior to version 1.10.3, a cross-site scripting (XSS) vulnerability exists in the application’s Markdown rendering logic. When user-supplied Markdown content is rendered, embedded raw HTML—including tags—is processed and injected into the resulting page without sanitization, allowing arbitrary JavaScript execution in t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-38615] DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-22926] Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24180] NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffe…

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24181] NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index …

NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-8025] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This issue affects CBS Platform: through 09062026.  NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49948] Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability …

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and emb…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24064] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24065] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privileged helper service. The helper validates connecting XPC clients using the client process identifier (PID) to verify code-signing identity. Because process identifiers can be reused, a local attacker can exploit a race condition between the time a connection request is made and th…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-10727] An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions…

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote authenticated attacker to execute arbitrary commands as root

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-7486] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Netcad Software Inc. E-İmar allows SQL Injection. This issue affects E-İmar: from 2.10.1.0 before 3.0.2.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2017-20251] WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that al…

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the ser…

nvdcriticovulnerabilidad CVSS 9.8 NVD