Alertas de Seguridad de la Información

A Alto vulnerabilidad

27/07/2026

[CVE-2026-48145] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. …

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-48586] Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++,…

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-66142] Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or …

Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-66143] It is possible to bypass the maximum number of normalized policy alternatives that was introduced in…

It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-66144] Although remote policy references are not retrieved during policy normalization, if they are manuall…

Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45813] Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS serv…

Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS service  "Add Source" and "Modify Source" operation PDU could results in stack buffer overflow or arbitrary out-of-bound read. This can be triggered by nearby devices over Bluetooth connection, however pairing is required prior to accessing BASS service, …

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45815] Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable R…

Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45816] NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This req…

NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would trigger before NULL dereference) and bogus (or misbehaving) controller, thus severity is low. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

24/07/2026

[CVE-2026-45811] Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBL…

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether a received HCI event would fit the configured event pool before copying it, allowing a buffer overflow. Severity is low: exploitation requires either a misconfigured pool size or a malicious/compromised controller on the other end of the HCI socket l…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

21/07/2026

[CVE-2026-60080] Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Ap…

Use After Free vulnerability in the Rust deserialization logic of Apache Fory. This issue affects Apache Fory from 0.13.0 through 1.3.0. A crafted Fory payload could cause undefined behavior, process crash, or potential memory disclosure. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Crítico vulnerabilidad

21/07/2026

[CVE-2026-64606] Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypas…

Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected This issue affects Apache Fory: from before 1.4.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

21/07/2026

[CVE-2026-64609] Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is…

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were …

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56624] Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java librar…

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options.…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-56452] Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for…

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames containing paths, resulting in files to be written in attacker-controlled places. The issue affects on…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-63071] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-57308] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are r…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-62183] Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow …

Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following scenario could happen. A REST API call can allow the user to grant themselves one or more of defined …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

20/07/2026

[CVE-2026-62418] Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via…

Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53421] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors' (REST and SQL) capability to run Groovy scripts. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. …

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53405] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from…

nvdcriticovulnerabilidad CVSS 9.8 NVD