Alertas de Seguridad de la Información

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46850] Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The suppo…

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attack…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46851] Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone…

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft E…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24155] NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploi…

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-48836] Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Unauthenticated Remote Code Execution (RCE) in Easy Invoice

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-39465] Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50880] An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to e…

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50871] An OS command injection vulnerability in the media archiving and export pipeline component of kanish…

An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50872] An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attacker…

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

R Crítico vulnerabilidad

15/06/2026

[CVE-2026-30120] remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability…

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-52704] Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P…

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

nvdcriticovulnerabilidad CVSS 10.0 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54057] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

nvdaltovulnerabilidad CVSS 7.8 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-42851] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write b…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval …

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45833] A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a…

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Crítico vulnerabilidad

12/06/2026

[CVE-2026-54133] jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem…

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into gener…

nvdcriticovulnerabilidad CVSS 9.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52858] Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi…

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is …

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52860] Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-comple…

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-con…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-47162] Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injecti…

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string lit…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-44495] Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. …

nvdaltovulnerabilidad CVSS 7.0 NVD