Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71350] picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run fu…

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71363] picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allow…

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71368] picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle fil…

picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71371] picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.ru…

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71374] picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used …

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7871] IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with …

IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.

nvdcriticovulnerabilidad CVSS 9.8 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-12240] The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficie…

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-46386] OpenProject is open-source, web-based project management software. Prior to , the official openproje…

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fix…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57527] Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulner…

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to Objec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-56057] Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.

Subscriber PHP Object Injection in Uncanny Automator Pro

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56055] Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Subscriber PHP Object Injection in RealHomes

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56031] Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.

Unauthenticated PHP Object Injection in Uncanny Automator

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-56032] Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.

Subscriber PHP Object Injection in Buddyboss Platform

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2025-71340] picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.Modifie…

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-46607] Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py…

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56053] Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Subscriber PHP Object Injection in EventPrime

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10043] MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulner…

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. T…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-56121] Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or …

Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_function.body field of an OnDemandFeatureView spec is decoded from base64 and passed to dill.loads() before any authorization check is performed, enabling attackers to e…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2025-71354] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.Object…

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

nvdaltovulnerabilidad CVSS 8.1 NVD