Alertas de Seguridad de la Información

K Alto vulnerabilidad

11/06/2026

[CVE-2026-11816] Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction ut…

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-7852] Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allo…

Unrestricted upload of file with dangerous type vulnerability in Limatek System Inc. LimRAD NAC allows Remote Code Inclusion. This issue affects LimRAD NAC: before 5.5.7.3.9.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-11561] Improper neutralization of special elements used in an expression language statement ('expression la…

Improper neutralization of special elements used in an expression language statement ('expression language injection') vulnerability in Soagen Informatics Technologies Software and Consulting Inc. Apinizer allows Code Injection. This issue affects Apinizer: from 2026.04.0 before 2026.04.6.

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-7250] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper input validation in the API request parsing middleware.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-8589] GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.1.4 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user to add unauthorized email addresses to a targeted user's account due to improper sanitization of user-supplied input in certain group setting fields.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-10087] GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 b…

GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary client-side code on behalf of a targeted user due to improper input sanitization in the Analytics Dashboard.

nvdaltovulnerabilidad CVSS 8.7 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-5497] vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attac…

vLLM versions 0.8.0 and later are vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the `VideoMediaIO.load_base64()` method. When processing `video/jpeg` data URLs, the method splits the base64 data string on commas to extract individual JPEG frames without enforcing a frame count limit. An attacker can exploit this by crafting a single …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2023-33999] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-41699] Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated G…

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 …

nvdaltovulnerabilidad CVSS 8.1 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-41700] Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Si…

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0…

nvdaltovulnerabilidad CVSS 8.1 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-41856] The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly re…

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40987] A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client file…

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40994] Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that i…

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40998] Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code p…

Jaxp13XPathTemplate evaluated XPath expressions for StreamSource and SAXSource inputs using a code path that parsed attacker-controlled XML with the JDK's default DocumentBuilderFactory behavior instead of Spring's hardened parser configuration. Applications that evaluate XPath against untrusted XML payloads could therefore be exposed to XML External Entity (XXE) style attacks. Affected versions:…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40999] When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate o…

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-10795] The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication B…

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a p…

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

11/06/2026

[CVE-2026-10520] Vulnerabilidad explotada activamente en Ivanti Sentry

CISA confirma explotación activa de una vulnerabilidad en Ivanti Sentry. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-14.

ivantiexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

10/06/2026

[CVE-2026-52726] Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlin…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-53460] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-53461] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

nvdaltovulnerabilidad CVSS 7.5 NVD