Alertas de Seguridad de la Información

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49414] The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code…

The ELF image activator cleared per-process ASLR preference flags for setuid binaries after the code that computes the PIE base address, rather than before. As a result, a user-requested ASLR disable was still in effect at the point where the base address was chosen. An unprivileged local user can disable ASLR for a setuid PIE binary by calling procctl(2) before execve(2). This makes exploitati…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49413] The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID …

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-gr…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49417] Second, the audio buffer backing a mapping could be freed when the device was closed even though the…

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, w…

nvdaltovulnerabilidad CVSS 7.0 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49412] The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter l…

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-45258] dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset an…

dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size. This addition could overflow, so that a large offset and length wrapped around and passed the check. The offset was then narrowed from 64 to 32 bits when converted to a buffer address, yielding a mapping that extended past the audio buffer into unrelated kernel me…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/06/2026

[CVE-2026-10820] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.17 does not verify that the user performing a subscription action owns the targeted subscription, allowing any authenticated user (Subscriber+) to cancel other users' active subscriptions via an Insecure Direct Object Reference.

nvdaltovulnerabilidad CVSS 8.1 NVD

H Alto vulnerabilidad

27/06/2026

[CVE-2023-37524] HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.…

HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service.  Since .NET Framework 4.5 has reached end-of-life and no longer receives security updates, it may expose the application to publicly known security weaknesses through vulnerable third-party components.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56414] A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticate…

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity o…

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-31928] The DMP-5000 devices are shipped with a default administrative web account with weak authentication …

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-33560] The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are expos…

The DMP-5000 file service exposes authenticated arbitrary file upload functionality. There are exposed endpoints which allows authenticated users to upload files of any type without validation. No file extension filtering or content inspection is enforced which allows executable binaries and scripts to be accepted and written directly to the server.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-55069] Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability e…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computation speed to recover the administrator password offline. In Kubernetes deployments, a successful crack fu…

nvdaltovulnerabilidad CVSS 8.7 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-49984] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past the guard using backslashes (..\..\..\); the guard sees a harmless string, and the path is only rewrit…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-36478] An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of se…

An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components

nvdaltovulnerabilidad CVSS 7.5 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-45807] Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several K…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only inspects the literal URI.toString(), so a URL-encoded .. written as %2E%2E slips through. The downstr…

nvdaltovulnerabilidad CVSS 7.7 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-54351] Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budib…

Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes the full HTTP request body into automation execution parameters. A mass assignment vulnerability in externalTrigger() allows an attacker to overwrite the internal appId property by including it in the webhook POST body. When the automation is processed asynchron…

nvdaltovulnerabilidad CVSS 8.2 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-54353] Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation p…

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connection later performs a separate DNS lookup through node-fetch. Since the validated IPs are never pinned to …

nvdaltovulnerabilidad CVSS 8.5 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48778] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="comma…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signature check. When the user triggers IDM_FILE_OPEN_CMD (File → Open Containing Folder → cmd), NppCommands.cpp:228 crea…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-48800] Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text con…

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the tag text content inside in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validation. When the user clicks the corresponding entry in the Run menu, NppCommands.cpp:4264 creates a Command object w…

nvdaltovulnerabilidad CVSS 7.8 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50132] Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token…

Budibase is an open-source low-code platform. Prior to 3.39.0, `GET /api/chat-links/:instance/:token/handoff` is a public endpoint (no auth required) that performs a permanent, state-changing operation: it binds an external chat identity (Slack/Discord/MS Teams) to an authenticated Budibase user account, with no consent UI and no CSRF protection. The session token in the URL is created by the atta…

nvdaltovulnerabilidad CVSS 7.3 NVD