Altas · Vulnerabilidades — Alertas SI

S Alto vulnerabilidad

14/07/2026

[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

P Alto vulnerabilidad

14/07/2026

[CVE-2026-50130] Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-…

Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.0 to 6.4.2, a user with code execution as the unprivileged pihole user can escalate to root by replacing /etc/pihole/logrotate. The replacement is laundered to root:root ownership by pihole-FTL-prestart.sh and then parsed as root by the daily pihole flush cron, executing firsta…

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48337] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48351] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48352] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48335] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48336] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48275] Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary cod…

Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48287] CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in a…

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48290] CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could…

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction …

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48295] CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that co…

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46638] Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ…

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46640] Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dyn…

Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56361] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifi…

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < curr…

M Alto vulnerabilidad

14/07/2026

[CVE-2026-61520] Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-…

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or lin…

M Alto vulnerabilidad

14/07/2026

[CVE-2026-52100] Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a …

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49477] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beau…

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49853] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHT…

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49855] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip …

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is …

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?