Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/06/2026

[CVE-2026-8095] The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File …

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during u…

nvdaltovulnerabilidad CVSS 8.1 NVD

Z Alto vulnerabilidad

28/06/2026

[CVE-2026-10643] Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()…

Zephyr's IP socket recvmsg() implementation (subsys/net/lib/sockets/sockets_inet.c, insert_pktinfo()) validated the user-supplied ancillary (msg_control) buffer using only the payload length (msg->msg_controllen < pktinfo_len) before writing a full control message consisting of an aligned cmsg header plus the payload. Because the check omitted the cmsg header size, a control buffer whose length fa…

nvdaltovulnerabilidad CVSS 8.7 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49416] The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large valu…

The CONS_HISTORY ioctl handler did not adequately validate the requested history size. A large value caused an integer overflow in the buffer size calculation, resulting in a heap allocation smaller than expected. Subsequent initialization of the buffer wrote beyond the end of the allocation. An unprivileged local user with access to a vt(4) device can trigger an out-of-bounds write in the kern…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49414] The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code…

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitati…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49413] The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID …

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-gr…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49417] Second, the audio buffer backing a mapping could be freed when the device was closed even though the…

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, w…

nvdaltovulnerabilidad CVSS 7.0 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49412] The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter l…

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-45258] dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset an…

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel me…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/06/2026

[CVE-2026-10820] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

27/06/2026

[CVE-2026-12415] The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing ca…

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentic…

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Alto vulnerabilidad

27/06/2026

[CVE-2023-37524] HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.…

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.  Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56414] A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticate…

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity o…

nvdaltovulnerabilidad CVSS 7.2 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-28701] Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated rem…

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-31928] The DMP-5000 devices are shipped with a default administrative web account with weak authentication …

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-33560] The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are expos…

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-55069] Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability e…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack fu…

nvdaltovulnerabilidad CVSS 8.7 NVD

K Crítico vulnerabilidad

26/06/2026

[CVE-2026-49869] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, Authentic…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated r…

nvdcriticovulnerabilidad CVSS 10.0 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-49984] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past the guard using backslashes (..\..\..\); the guard sees a harmless string, and the path is only rewrit…

nvdaltovulnerabilidad CVSS 7.7 NVD

K Crítico vulnerabilidad

26/06/2026

[CVE-2026-53576] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authe…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. kestra addresses its resources by URL path segments that the caller chooses (/api/v1/{tenant}/flows/{namespace},…

nvdcriticovulnerabilidad CVSS 10.0 NVD