Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13519] A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting…

A vulnerability was found in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13521] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affect…

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the file /preview5.php. Such manipulation of the argument course_year_section leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13517] A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasic…

A flaw has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13518] A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat …

A vulnerability has been found in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13515] A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function form…

A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13516] A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSe…

A vulnerability was detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-48558] Vulnerabilidad explotada activamente en SimpleHelp SimpleHelp

CISA confirma explotación activa de una vulnerabilidad en SimpleHelp SimpleHelp. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-02.

simplehelpexplotación activavulnerabilidad CISA KEV

J Crítico vulnerabilidad

28/06/2026

[CVE-2026-49048] The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by …

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13500] A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the …

A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13498] A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unk…

A vulnerability was identified in yashpokharna2555 restaurent-management-system. This affects an unknown function of the file /forgotpassword.php of the component POST Parameter Handler. Such manipulation of the argument email leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. This product does not use versioning. This is why informati…

nvdaltovulnerabilidad CVSS 7.3 NVD

C Informativo vulnerabilidad

28/06/2026

[CVE-2026-13493] A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown proce…

A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper control of resource identifiers. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitab…

check-pointcheckpointbajo CVSS 3.1 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13488] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. A…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/7.php. Affected by this vulnerability is an unknown functionality of the file /preview7.php. The manipulation of the argument course_year_section results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13487] A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is …

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /archive.php. The manipulation of the argument sy leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13486] A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This i…

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/6.php. This impacts an unknown function of the file /preview6.php. Executing a manipulation of the argument course_year_section can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-13485] A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an u…

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown function of the file /preview.php. Performing a manipulation of the argument course_year_section results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

Z Alto vulnerabilidad

28/06/2026

[CVE-2026-10646] Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a po…

Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless ti…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

28/06/2026

[CVE-2026-58050] libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsyste…

libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

28/06/2026

[CVE-2026-58053] Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options…

Gitea act_runner with the Docker backend (through act 0.262.0) passes a workflow's container.options string to the Docker job container's HostConfig and, when configured with privileged: false, forces only the Privileged flag off while merging options such as --pid=host, --cap-add, and --security-opt unchanged. A user who can run a workflow on a Docker-backed runner can create a job container with…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-58056] RustDesk gates incoming control messages on per-capability flags rather than on the session's author…

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-58049] FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at t…

FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled ou…

nvdaltovulnerabilidad CVSS 8.6 NVD