Alertas de Seguridad de la Información

A Crítico vulnerabilidad

17/06/2026

[CVE-2026-49268] A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction i…

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonati…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-9570] The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before ech…

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54194] Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Contributor PHP Object Injection in Fusion Builder

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54195] Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.1 NVD

A Crítico vulnerabilidad

17/06/2026

[CVE-2026-50203] A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`…

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-p…

nvdcriticovulnerabilidad CVSS 9.1 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-48929] Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vul…

Rocket.Chat in versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-42385] Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro

nvdaltovulnerabilidad CVSS 7.1 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-12455] Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who c…

Use after free in Tab Strip in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69148] Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

Unauthenticated Local File Inclusion in Quirky

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2025-48617] In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a …

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

17/06/2026

[CVE-2026-48294] Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cros…

Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. An attacker could exploit this vulnerability to gain access to data regarding the victim's session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is cha…

nvdaltovulnerabilidad CVSS 7.4 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46970] Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal …

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle HR Intelligence. CVSS …

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46971] Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal …

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle HR Intelligence. CVSS…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46972] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46973] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46976] Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Int…

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sec…

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46959] Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Inte…

Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Subledger Accounting. Successful attacks of this vulnerability can result in takeover of Oracle Subledger A…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46960] Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component…

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle …

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46961] Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component…

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle P…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46962] Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component…

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle P…

nvdaltovulnerabilidad CVSS 8.8 NVD