Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50231] Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in t…

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by crafting values that get logged such as URLs, User-Agent headers, stream titles, or player names to exe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50232] Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers…

Lyrion Music Server 9.2.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts through media file metadata tags like GENRE, ARTIST, and ALBUM. Attackers can craft files with XSS payloads in metadata tags that execute in the web interface when users view track information or play files, enabling access to management functions and settings disclosure…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50234] Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack…

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11332] A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency speci…

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galax…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-49777] Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider…

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-6274] Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerabi…

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50593] Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actio…

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-7762] A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micr…

A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information El…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-7763] A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro …

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. T…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-41567] Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to…

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operation…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-10877] A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up…

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-10586] The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress i…

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web applicati…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

04/06/2026

[CVE-2024-27892] Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when…

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-8873] On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause…

On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10872] A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserve…

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10873] A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of t…

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

04/06/2026

[CVE-2024-27890] Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when…

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10871] A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function s…

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10870] A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file …

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41249] CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitH…

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow (`.github/workflows/static.yml`) uses the `pull_request_target` trigger but dangerously checks out the unverified code from the pull request head (`ref: ${{ github.event.pull_request.head.ref }}`). Subsequently, it executes a script (`bin/console`) from this untrusted checkout. T…

nvdaltovulnerabilidad CVSS 8.2 NVD