Alertas de Seguridad de la Información

E Alto vulnerabilidad

10/07/2026

[CVE-2026-59161] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39244] adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated u…

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read d…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

10/07/2026

[CVE-2026-33382] Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request bo…

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-40007] Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_a…

Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the E-language prefix in socket data, with no depth limit. An unauthenticated attacker can send a stream of repeated E-language prefixes that drives the recursion arbitrarily …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51600] Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP request…

Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not ac…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-15308] The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeat…

The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54772] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per conn…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-51535] In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in …

In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-59936] pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PD…

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.1, an attacker can craft a PDF with a page content stream containing a not terminated inline image, causing an infinite loop during inline image end marker detection such as when extracting page text. This issue is fixed in version 6.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58210] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, an unauthenticated MQTT client could cause the server to retain large incomplete MQTT CONNECT packets before authentication completed, consuming server memory while the parser waited for the advertised MQTT packet length. This issue is fixed in versions 2.14.3 and 2.12.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-59937] pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PD…

pypdf is a free and open-source pure-python PDF library. Prior to 6.14.0, an attacker can craft a PDF with repeated malformed cross-reference streams that cause pypdf to spend long runtimes recovering broken cross-reference table entries. This issue is fixed in version 6.14.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59879] Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set,…

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abor…

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40140] BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication v…

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-9165] A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit…

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

nvdaltovulnerabilidad CVSS 7.7 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-24012] Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose re…

Uncontrolled Resource Consumption vulnerability in Apache IoTDB.  Some interface fails to impose reasonable limits on the time span and aggregation interval of the query. An attacker can construct a request with extreme parameters (e.g., a very large time range combined with a minimal interval). This forces the DataNode to build an enormous result set in memory, which exhausts the Java heap and c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-26307] Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searc…

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-52192] An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of se…

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-9563] In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not e…

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, o…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54428] Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpCompo…

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54399] Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpCompone…

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

nvdaltovulnerabilidad CVSS 7.5 NVD