Alertas de Seguridad de la Información

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53143] In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow…

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 The v11 MQD manager incorrectly assigned the CP-compute variants of checkpoint_mqd/restore_mqd for KFD_MQD_TYPE_SDMA queues. These functions use sizeof(struct v11_compute_mqd) (2048 bytes) instead of sizeof(struct v11_sdma_mqd) (512 bytes), causing a 1536-…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53145] In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_hand…

In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4 [airlied: just added some comments on how to reenable] On-list because the cat is out of the bag and we're clearly not good enough to figure this out in private. The story thus far: 5e28b7b94408 ("drm: Set old handle to NULL before prime swap in change_handle") tried to fix a r…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53146] In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain resp…

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Limit XDomain response copy to actual frame size tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53131] In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC…

In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb…

nvdcriticovulnerabilidad CVSS 9.4 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53132] In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unb…

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix potential unbounded skb queue virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc. virtio_transport_recv_enqueue() skips coalescing for packets with VIRTIO_VSOCK_SEQ_EOM. If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM, a very large number of packets can be queued because vvs-…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53133] In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for b…

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix truncation for block sizes >= 4G When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for bl…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53136] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HD…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size [Why & How] The VBIOS integrated info tables (v1_11 and v2_1) contain HdmiRegNum and Hdmi6GRegNum fields that are used as loop bounds when copying retimer I2C register settings into fixed-size arrays (dp*_ext_hdmi_reg_settings[9] and dp*_ext_hdmi_6g_reg_setti…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12937] The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for Word…

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12245] NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing …

NSD from version 4.13.0 has a heap use-after-free bug in logging errors on TLS connections, causing a crash of the server process, which can be triggered trivially by sending a DNS query over a DoT connection, and closing the connection without reading the response.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12246] NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than …

NSD version 4.14.0 introduced a bug where a specially crafted APL RR, with an adflength larger than permitted for the address family will overwrite the stack when the zone is written to disk, with a maximum of 111 attacker controlled bytes.

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12490] When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a…

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-5305] The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin bef…

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-9702] The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the leg…

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer before allowing the WooCommerce order parcel-locker destination to be updated, allowing unauthenticated attackers to silently redirect the shipping destination of any pending or processing order on the site.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12244] If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR co…

If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 6550…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-13311] shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a redu…

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-10086] GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 be…

GitLab has remediated an issue in GitLab EE affecting all versions from 16.4 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code in the context of another user's session, due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-10712] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to execute arbitrary JavaScript in a user's browser session due to improper path validation under certain conditions.

nvdaltovulnerabilidad CVSS 8.0 NVD

G Alto vulnerabilidad

25/06/2026

[CVE-2026-12053] GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that unde…

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filtering in Duo Workflows.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12077] The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' …

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-8660] OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux …

OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands.

nvdaltovulnerabilidad CVSS 7.7 NVD