Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53828] SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronizatio…

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 1…

nvdaltovulnerabilidad CVSS 8.5 NVD

G Alto vulnerabilidad

06/07/2026

[CVE-2026-58380] A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pn…

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13705] Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SG…

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13708] Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated…

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, s…

nvdaltovulnerabilidad CVSS 7.5 NVD

W Alto vulnerabilidad

06/07/2026

[CVE-2026-4249] The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payload…

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate AP…

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-49042] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46587] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46588] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55994] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange).…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-9165] A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit…

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.

nvdaltovulnerabilidad CVSS 7.7 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55993] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache …

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value was the plain string QUERY (and RETURN_LUCENE_DOCS for HEADER_RETURN_LUCENE_DOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderF…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa…

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operat…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46726] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (VertxWebsocketConsumer.populateExchangeHeaders()). Be…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48203] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), …

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48205] Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS comp…

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers whose constant values (DnsConstants.DNS_SERVER, DNS_NAME, DNS_DOMAIN, DNS_TYPE, DNS_CLASS, TERM) were t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46454] Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen…

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46455] Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloa…

Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The camel-keycloak security helper KeycloakSecurityHelper.parseAndVerifyAccessToken builds a Keycloak TokenVerifier using withChecks(...) with only the subject-exists check and the realm-URL (issuer) check. Keycloak's TokenVerifier.withChecks(...) appends to an initially empty check list - the upstream default check…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46456] Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs com…

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not…

nvdcriticovulnerabilidad CVSS 9.8 NVD