Alertas de Seguridad de la Información

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16382] Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153…

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16383] Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Fir…

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16388] Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thu…

Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16377] Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox …

Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16370] Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and …

Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16356] Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was…

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-44982] CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/re…

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON,…

nvdaltovulnerabilidad CVSS 7.2 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48807] Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully c…

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48805] Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/…

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48806] Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping…

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-46634] Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inn…

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__ name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version …

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46638] Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ…

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50646] Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local…

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47305] Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall…

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61437] PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln…

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandbo…

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0278] Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) compone…

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

04/07/2026

[CVE-2026-14535] In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc…

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequen…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71373] picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allow…

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

nvdaltovulnerabilidad CVSS 8.1 NVD