Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-54419] claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi…

claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commit 389d2633441b65ced1c104212cd62be2bfca21e5) contains multiple unauthenticated SQL injection vulnerabilities. The application has no authentication mechanism and passes user-supplied HTTP parameters directly into deprecated mysql_query() calls via string concatenation, without sanitization, escaping,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-55742] Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the ad…

Cotonti 1.0.0 (master branch, commit f43f1fc3) is vulnerable to Cross-Site Request Forgery in the administration rights handler. In system/admin/admin.rights.php, the rights update action ('a=update') modifies group access rights (including via cot_auth_add_group) without calling cot_check_xg() to validate the anti-CSRF token. A remote attacker who lures an authenticated administrator into visitin…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-55740] Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad)…

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=$busid) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context. A remote…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-48768] TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/ge…

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any anonymous visitor to a published bot with a file input can upload attacker-controlled HTML, SVG, or JS to att…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54387] Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and…

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54388] Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Cont…

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-48814] Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP …

Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw d…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-55196] Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration…

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-53805] NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vuln…

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

R Crítico vulnerabilidad

17/06/2026

[CVE-2026-3894] Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffer…

Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.0.0 before 5.2.*.

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Crítico vulnerabilidad

17/06/2026

[CVE-2026-30803] Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Ov…

Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

17/06/2026

[CVE-2026-20266] In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute ar…

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-53873] picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block …

picklescan before 1.0.4 contains an incomplete blocklist for the profile module that fails to block the module-level profile.run() function, allowing attackers to achieve arbitrary code execution via exec(). Attackers can craft malicious pickle files calling profile.run(statement) to execute arbitrary Python code while picklescan reports zero security issues.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-53874] picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated us…

picklescan before 1.0.1 contains an unsafe deserialization vulnerability allowing unauthenticated users to execute arbitrary code by hiding eval calls nested under callable objects via getattr. Attackers can embed malicious code in pickle files that evades detection but executes when the pickle is loaded from untrusted sources.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-3490] picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire…

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-36418] JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling…

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.1 NVD

C Crítico vulnerabilidad

17/06/2026

[CVE-2026-20181] A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute ar…

A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-71323] picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code…

picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw memory. Attackers can craft malicious pickle files using ctypes.WinDLL to load kernel32.dll and execute arbitrary commands, bypassing sandbox protections and gadget chain detection.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-71325] picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling …

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-71320] picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and opera…

picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle files using these unblocked functions to achieve arbitrary code execution when the pickle is deserialized.

nvdcriticovulnerabilidad CVSS 9.8 NVD