Alertas de Seguridad de la Información

H Crítico vulnerabilidad

03/06/2026

[CVE-2026-5241] A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows…

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when lo…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37460] Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.…

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2022-49042] An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in …

An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2022-49036] An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration i…

An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35084] A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain…

A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access as root.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35085] A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to ga…

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system access as root.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35079] The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files…

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35080] The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local f…

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35081] The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processe…

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35082] The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files…

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35083] A remote attacker with user privileges can exploit a stack buffer overflow to gain full system acces…

A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

03/06/2026

[CVE-2026-35075] An unauthenticated remote attacker can recover a default, hard coded password from a firmware image …

An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35076] The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local fi…

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35077] The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local …

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35078] The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local file…

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

03/06/2026

[CVE-2025-14774] Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15655] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This issue affects School Management: from n/a through 93.2.0.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2025-15656] Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalati…

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-41032] It is possible for an unauthenticated adjacent attacker to download log files of the controller, whi…

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

03/06/2026

[CVE-2026-47065] ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Pro…

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which perform…

nvdcriticovulnerabilidad CVSS 9.8 NVD