Alertas de Seguridad de la Información

A Alto vulnerabilidad

08/06/2026

[CVE-2026-44185] Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker contr…

Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-44186] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in …

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-44631] Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configur…

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46274] In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecess…

In the Linux kernel, the following vulnerability has been resolved: io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46275] In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs a…

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the lifecycle management of hci_uart. The primary issue arises because the workqueues (init_ready and write_work) are only flushed/cancelled if …

nvdaltovulnerabilidad CVSS 7.8 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-42535] A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to d…

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-42536] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and…

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-42861] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation …

nvdcriticovulnerabilidad CVSS 9.6 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-42863] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side valid…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-34355] A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an …

A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-34356] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and Pr…

Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11523] A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the…

A flaw has been found in Tenda W20E 15.11.0.6. This issue affects the function formPortalAuth of the file /goform/PortalAuth of the component Web Management Interface. Executing a manipulation of the argument gotoUrl can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11524] A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRul…

A vulnerability has been found in Tenda W20E 15.11.0.6. Impacted is the function modifyWifiFilterRules of the file /goform/modifyWifiFilterRules of the component Web Management Interface. The manipulation of the argument wifiFilterListRemark leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11528] A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 …

A vulnerability was found in Tenda AC18 15.03.05.05. The affected element is the function sub_45304 of the file /goform/getRebootStatus of the component Web Management Interface. The manipulation of the argument callback results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-22164] Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt…

Software installed and run as a non-privileged user may conduct improper GPU system calls to corrupt kernel heap memory. By creating resources of certain types and presenting a set of parameters to the affected interface the exploit can be used to corrupt kernel memory.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-29167] Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration Thi…

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11522] A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSe…

A vulnerability was detected in Tenda W20E 15.11.0.6. This vulnerability affects the function formSetPortMirror of the file /goform/setPortMirror. Performing a manipulation of the argument portMirrorMirroredPorts results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11517] A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strc…

A vulnerability was determined in UTT HiPER 2610G up to 3.0.0-171107. This impacts the function strcpy of the file /goform/formConfigDnsFilterGlobal. Executing a manipulation of the argument GroupName can lead to buffer overflow. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-50752] A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an una…

A weakness in the certificate validation logic of the deprecated IKEv1 key exchange may allow an unauthenticated attacker positioned as a man-in-the-middle to bypass certificate validation in VPN site-to-site connections that use certificate-based authentication. Successful exploitation could allow interception or modification of traffic traversing the VPN tunnel.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11504] A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSch…

A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD