Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-47743] Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to ta…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-15615] Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audien…

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-43820] NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSS…

NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-59555] Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Unauthenticated Arbitrary File Deletion in Participants Database

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-59525] Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions.

Unauthenticated SQL Injection in Participants Database

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64611] A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite l…

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65755] Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Use…

Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64799] Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users …

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible fold…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-64793] Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and …

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-64796] Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free di…

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured inc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-14881] When importing connections in Compass it is possible to override some connection options that are ot…

When importing connections in Compass it is possible to override some connection options that are otherwise can't be changed via connection form. In particular it is possible to provide a custom browser open command for OIDC auth flow that is usually can be set only globally via Compass settings.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13204] If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there e…

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-11605] The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always vali…

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authoritative server/zone which returns many valid but superfluous RRSIG records causes the validator to waste disproportionate CPU time. This issue affects BIND 9 versions 9.20.0 through 9.20.24, 9.21.0 throug…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-55973] In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the…

In NLnet Labs Unbound 1.23.0 up to and including 1.25.1, when 'dns-error-reporting: yes' is set, the EDNS Report-Channel option (code 18) from the last upstream response is read and uses the option's length as the length of the agent domain. When a domain name check is performed on the agent domain, the returned lenght is not used and if the agent domain is followed by garbage, those bytes are mov…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-57600] Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthe…

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

21/07/2026

[CVE-2026-56820] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an…

nvdaltovulnerabilidad CVSS 7.4 NVD

G Alto vulnerabilidad

21/07/2026

[CVE-2026-16422] Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7…

Insufficient validation of untrusted input in Certificate in Google Chrome on Linux prior to 150.0.7871.182 allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65319] Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allow…

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and ext…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61183] Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply …

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60768] Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Gr…

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Graph / Charting). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized creation, deletio…

nvdaltovulnerabilidad CVSS 8.1 NVD