Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/06/2026

[CVE-2026-54413] driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read i…

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_SecurityAccess() function in iso14229.c that allows a remote unauthenticated attacker to crash a UDS server and potentially read memory past the receive buffer by sending a single-byte 0x27 SecurityAccess request that follows any earlier well-formed 0x27 message. The handler reads …

nvdaltovulnerabilidad CVSS 8.2 NVD

D Alto vulnerabilidad

13/06/2026

[CVE-2026-12174] A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the functi…

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the file /web/cgi-bin/greece/rhea of the component HTTP Handler. Such manipulation of the argument data leads to format string. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/06/2026

[CVE-2026-12183] Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains a…

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=&pwd=), and subsequent pr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-6428] SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before…

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary data from the Koha application database via the Filter URL parameter when the Criteria parameter matches…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-5513] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user ac…

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

13/06/2026

[CVE-2026-11769] We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity secur…

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-54228] A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetEl…

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive post-create processing.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6676] Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed PO…

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.27.12.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-12068] Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may al…

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacker operating a cross-origin iframe to obtain credentials autofilled for the parent web page via incorrect autofill field selection. This issue affects Avira Password Manager when used with Mozilla Firefox on Windows, macOS, and Linux.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9033] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.76.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-9032] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Win…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.98.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-14098] Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when…

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.104.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-53868] Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register acco…

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary email addresses without verification, then initiate deletion to lock emails in pending deletion state. Attackers can permanently lock legitimate users out of the platform for 30 days by exploiting unverified email ownership in account lifecycle operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53836] OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command h…

OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in PowerShell encoded-command handling that allows attackers to execute encoded commands using abbreviated flag aliases not recognized by the allowlist parser. Remote authenticated operators can bypass execution allowlist checks by using unrecognized encoded-command alias forms to execute arbitrary PowerShell content.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Crítico vulnerabilidad

12/06/2026

[CVE-2026-53838] OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that …

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes to confuse approval scope decisions. Attackers can exploit reconnection logic to restore or present broader node authority than intended, potentially bypassing approval restrictions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53828] OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling t…

OpenClaw before 2026.5.6 contains an authorization bypass vulnerability in native command handling that allows authenticated senders to execute owner-only commands without proper policy enforcement. Attackers can trigger native command handling to bypass the configured owner-command access control, potentially executing privileged commands from unauthorized users.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53829] OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticat…

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53831] OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowli…

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53832] OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-h…

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

nvdaltovulnerabilidad CVSS 7.7 NVD