Alertas de Seguridad de la Información

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66279] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66280] An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating s…

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and …

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-62850] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 an…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2025-66276] QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.…

QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later

nvdcriticovulnerabilidad CVSS 9.8 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45542] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a heap buffer overflow exists in the Security Scheme 2 (SRP6a) session-setup path of the protocomm component. The first-phase handler (handle_session_command0() in components/protocomm/src/security/security2.c) trusts the length of a client-supplied protobuf field for the SRP6a…

nvdaltovulnerabilidad CVSS 7.1 NVD

E Crítico vulnerabilidad

10/06/2026

[CVE-2026-45328] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA update…

nvdcriticovulnerabilidad CVSS 9.3 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45329] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machi…

nvdaltovulnerabilidad CVSS 7.1 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45541] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0, a NULL-pointer dereference exists in the WebSocket subprotocol-negotiation path of the esp_http_server component. While parsing the client-supplied Sec-WebSocket-Protocol request header during the WebSocket handshake, the tokenisation result is dereferenced without a NULL check…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53673] BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST AP…

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused b…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53674] BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention reso…

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when username compatibility mode is enabled, allows attackers to manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Attackers can submit @mentions whose metacharacters pass through esc_sql unescaped and are inserted into an unprepared REGEXP que…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46541] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator is only initialized when the first DHT record passes verification. If the first record fails (from a malicious DHT node), DhtResults is never created, and all subsequent valid records are discarded with "DHT inconsi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46545] Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus…

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability in MerkleRadixTrie::put_chunk allows any state-sync peer to crash any node performing state synchronization (freshly joining nodes and recovering nodes). This issue has been patched in version 1.5.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-44716] Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa…

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is conca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46432] LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46491] SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp mod…

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46517] LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46518] OpenEMR is a free and open source electronic health records and medical practice management applicat…

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding i…

nvdaltovulnerabilidad CVSS 7.7 NVD

V Alto vulnerabilidad

10/06/2026

[CVE-2026-41728] Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-…

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

10/06/2026

[CVE-2026-41729] Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when proces…

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed property, the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation. Affected versions: Spring Data REST 3.7.0 through 3.7.19; …

nvdaltovulnerabilidad CVSS 8.1 NVD

V Alto vulnerabilidad

10/06/2026

[CVE-2026-41731] JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trust…

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types. Affected versions: Spring f…

nvdaltovulnerabilidad CVSS 8.1 NVD