Alertas de Seguridad de la Información

I Alto vulnerabilidad

10/06/2026

[CVE-2026-49218] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2026-50223] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low…

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2026-47342] A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to o…

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-46695] Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and la…

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-46703] Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and la…

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in OCI images, Boxlite does not account for the possibility that entries may be symlinks pointing to ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42305] Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting wit…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Cont…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42558] Xibo is an open source digital signage platform with a web content management system and Windows dis…

Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.2, a vulnerability chain consisting of Stored XSS and Iframe Sandbox escape in the Xibo CMS allows users with DataSet permissions to use the Data Connector functionality to craft messages which escape the sandbox and facilitate XSS. Exploitation of the vulnerabilit…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-44693] Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior…

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-53738] Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in t…

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp_action_handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-48110] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several r…

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50131] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify pre…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete.…

nvdaltovulnerabilidad CVSS 8.6 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46669] OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior t…

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patche…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46673] Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capac…

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth before validation. In older russh releases before 0.58.0, remote SSH traffic also reached CryptoVec thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46679] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three co…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46702] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH …

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.1, when SSH compression is enabled, russh accepted compressed packets whose on-wire size passed the normal transport packet-length checks but whose decompressed size was much larger. This allowed a remote peer to send oversized post-decompression packets that should have been rejected. In current releases, this…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-46520] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-46522] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46625] JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-…

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign() helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "__proto__" member is an own enumerable property, so the for…in enumerates it and the target[key] = source[key] write triggers the Object.prototyp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42462] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to v…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions …

nvdaltovulnerabilidad CVSS 7.0 NVD