Alertas de Seguridad de la Información

P Alto vulnerabilidad

07/07/2026

[CVE-2026-56812] Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Pres…

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-44938] A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-se…

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-14476] A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() funct…

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to auth…

nvdaltovulnerabilidad CVSS 8.0 NVD

G Alto vulnerabilidad

07/07/2026

[CVE-2026-58384] A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an unders…

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-12375] The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after …

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-14345] The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress…

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_sho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-42200] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution thr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34168] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a storage name containing shell metacharacters and execute commands on managed servers when the resource is …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34058] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without any sanitization or escaping. This parameter is interpolated directly into shell commands e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

nvdaltovulnerabilidad CVSS 7.5 NVD

K Crítico vulnerabilidad

06/07/2026

[CVE-2026-57571] Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler sa…

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename containing an absolute path or traversal escaped the downloads directory, giving an arbitrary file write with attacker-controlled contents; t…

nvdcriticovulnerabilidad CVSS 9.6 NVD

T Crítico vulnerabilidad

06/07/2026

[CVE-2026-54763] Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik'…

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can i…

nvdcriticovulnerabilidad CVSS 10.0 NVD

Q Alto vulnerabilidad

06/07/2026

[CVE-2026-21383] Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requir…

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-11405] The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() …

The web server binary /bin/httpd contains a hidden backdoor authentication mechanism in the login() function at 004c88b8. - The function contains a normal authentication path using MD5/hash-based password verification (prod_encode64/PasswordToMd5/check_rand_key). - After normal authentication fails, it calls GetValue("sys.rzadmin.password") to read a backdoor password from the device configura…

nvdcriticovulnerabilidad CVSS 9.8 NVD

E Crítico vulnerabilidad

06/07/2026

[CVE-2026-9181] Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is …

Esri ArcGIS Server contains a directory traversal vulnerability. ArcGIS Enterprise on Kubernetes is not impacted. An unauthenticated attacker could exploit this issue by sending crafted path parameters. Successful exploitation could allow overwriting sensitive files on the system. Abuse of this issue can allow full administrative access to ArcGIS Server, with high impact to confidentiality, integr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13753] A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Pri…

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40140] BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication v…

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

nvdaltovulnerabilidad CVSS 7.5 NVD

B Crítico vulnerabilidad

06/07/2026

[CVE-2026-40141] A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support an…

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53831] DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and s…

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 t…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53829] ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to versio…

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.

nvdaltovulnerabilidad CVSS 8.0 NVD