Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 9 horas

[CVE-2026-19574] The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare ro…

The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory domains with a bare round-robin counter in arch_mem_domain_init() (arch/arm64/core/mmu.c). VM_ASID_BITS is 8, so only 255 ASIDs exist; once the counter wrapped, arch_mem_domain_init() could hand an ASID to a new domain while a still-live domain held the same one. Domain-private mappings are installed non-global (MT_NG), …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad Nuevo

Hace 10 horas

[CVE-2026-97076] Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Inject…

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 10 horas

[CVE-2026-93548] The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitle…

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in that user's account details being exposed and their account being taken over.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 10 horas

[CVE-2026-81929] The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross…

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad Nuevo

Hace 10 horas

[CVE-2025-15700] The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from…

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-107909] A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_…

A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only boun…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-107910] An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in F…

An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is require…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-107911] A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in Falkor…

A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure wit…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-107914] Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration ex…

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-107908] A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB b…

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 12 horas

[CVE-2026-7826] A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/ser…

A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the re…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad Nuevo

Hace 12 horas

[CVE-2026-7827] A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializ…

A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service and possibly execute arbitrary code by supplying a crafted RDB stream with a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad Nuevo

Hace 12 horas

[CVE-2026-5759] A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph …

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-94510] Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attack…

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-96207] Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to eleva…

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-83943] Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorize…

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-83947] Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a n…

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-88131] Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute …

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-77900] Missing authentication for critical function in Azure App Service allows an unauthorized attacker to…

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-69435] Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a …

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD