Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-74737] In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nu…

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG On the packet reception path, the ID of the MAC Port on which the packet was received, is embedded in the RX DMA Descriptor's metadata. The ID is extracted using the helper function cppi5_desc_get_tags_ids() which fills in the 16-bit Source Tag into the 'port…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74739] In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash t…

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: skip hash tables in u32_bind_class() u32_walk() enumerates both struct tc_u_hnode and struct tc_u_knode through the walker callback. u32_bind_class() unconditionally casts the passed fh to tc_u_knode and accesses &n->res, so when fh is actually a tc_u_hnode, which has no tcf_result member, this results in a s…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74741] In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer der…

In the Linux kernel, the following vulnerability has been resolved: net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling In non-MSI-X mode (such as legacy INTx or single MSI), wx->msix_entry is not allocated or initialized. Calling NGBE_INTR_MISC(wx) dereferences wx->msix_entry->entry, leading to a NULL pointer dereference crash. This issue was introduced by fixing the IRQ ve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-74742] In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to w…

In the Linux kernel, the following vulnerability has been resolved: veth: fix queue index used to wake the peer txq in veth_poll veth_poll() derives the index of the peer TX queue to wake from rq->xdp_rxq.queue_index. That field is only initialized by xdp_rxq_info_reg() in veth_enable_xdp_range(), which runs only when an XDP program is attached. On the plain GRO/NAPI path (veth_napi_enable_range…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-54550] IzPack is a widely used tool for packaging applications on the Java platform as cross-platform insta…

IzPack is a widely used tool for packaging applications on the Java platform as cross-platform installers. In 5.2.6 and earlier, UnpackerBase.unpack() in izpack-installer/src/main/java/com/izforge/izpack/installer/unpacker/UnpackerBase.java obtains an attacker-controlled PackFile targetPath, passes it through IoHelper.translatePath(), which only converts separators, and constructs a File without n…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-54511] LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog p…

LogTape is an unobtrusive logging library. Prior to 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package's escapeStructuredDataValue() function in packages/syslog/src/syslog.ts does not neutralize C0 control characters from U+0000 through U+001F in structured data values, and formatStructuredData() inserts property keys without validating the RFC 5424 SD-NAME grammar. When includeStructuredData …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-54523] Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1…

Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compile…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-75896] Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institu…

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk: before 3.5.5.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-75960] Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credential…

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-73108] RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability i…

RustDesk versions before 1.4.7 contain an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length encoded in a four-byte frame header and reserves that amount before receiving the payload. A crafted header can request up to 1,073,741,823 bytes of capacity, allowing unauthenticated attackers to use concurrent TCP connectio…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-18252] GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 bef…

GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19271] Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability i…

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-15990] The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up t…

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Cha…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77658] A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network…

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. In objects/network/bus.c, bus_load() reads the number of bus handles from the file attribute "bus_handles" using attribute_num_data() without validating an upper bound: bus->num_handles = attribute_num_data(attr); When a bus handle is subsequently move…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-15985] The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentica…

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by subm…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77551] A malicious actor with access to the network and under certain conditions could exploit an Improper …

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Connect Display Cast Pro to escalate privileges on the device.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77552] A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit…

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77553] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77554] A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit…

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

26/08/2026

[CVE-2026-77557] A malicious actor with access to the network could exploit an Improper Access Control vulnerability …

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to escalate privileges on the device.

nvdcriticovulnerabilidad CVSS 9.8 NVD