Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54832] Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

Unauthenticated Broken Access Control in Gutenverse Companion

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54833] Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

Unauthenticated Backdoor in Enable CORS

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54834] Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

26/06/2026

[CVE-2026-45257] The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data …

The KTLS receive path decrypted each record in place, assuming that the mbufs holding received data were anonymous and safe to modify. This assumption does not hold for data placed on a socket by sendfile(2), which can reference file-backed memory directly through non-anonymous M_EXTPG pages or EXT_SFBUF mbufs. When the sender transmits such data over a loopback connection without enabling KTLS …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-54820] Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions.

Unauthenticated SQL Injection in JetBooking

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-30041] An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to ex…

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2025-68052] Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2025-68063] Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Ho…

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2025-68064] Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

26/06/2026

[CVE-2026-57920] Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-cont…

Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57915] It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA …

It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-40711] Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-power…

Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2025-55017] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2025-64152] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57912] Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited s…

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57913] Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meetin…

Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57918] libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_sock…

libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker.

nvdaltovulnerabilidad CVSS 7.1 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-13325] A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set…

A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-11625] Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. …

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-11702] Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked proce…

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produced. Secrets generated in multiprocess applications are predictable across processes.

nvdaltovulnerabilidad CVSS 7.5 NVD