Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61023] An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cau…

An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61025] An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to c…

An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61027] An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cau…

An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61028] An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to c…

An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61018] An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers…

An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61019] An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attacker…

An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56815] pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in th…

pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-35019] NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulner…

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded AES-256 key used to encrypt session cookies for the web management interface. Attackers can forge a valid encrypted session cookie using the shared hardcoded key and bypass authentication checks to …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-35018] NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code ex…

NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the username JSON parameter processed by the dalStorage_addUserAccount function. Attackers can exploit the unsafe concatenation of user-supplied input into a shell c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56784] OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bu…

OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users to permanently delete alarms belonging to other tenants by supplying arbitrary alarm IDs. The removeAlarms() method in AlarmResourceImpl.java omits realm-scoping validation in its JPA query, enabling any user with alarm-write permissions to …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

23/06/2026

[CVE-2026-56315] picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uui…

picklescan before 1.0.4 fails to block at least seven Python standard library modules (including uuid, _osx_support, _aix_support, _pyrepl.pager, and imaplib) exposing eight functions that provide direct arbitrary command execution. Attackers can craft malicious pickle files importing these unblocked modules to achieve remote code execution while bypassing picklescan's safety validation entirely.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56322] Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updat…

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that resolves the defaultChannel parameter before enforcing privacy restrictions, allowing attackers to enumerate private channels and leak version/config state. Unauthenticated attackers can probe private channel names and distinguish valid channels from nonexistent ones based on respon…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56222] Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings …

Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped role binding creation. An attacker with administrative privileges in one organization can create role bindings targeting applications owned by other organizations, enabling unauthorized read and modification of victim applications.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56225] Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key managemen…

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers (get/put/delete/post). API keys created with mode=all but restricted to a single app via limited_to_apps are only checked for limited_to_orgs and not for limited_to_apps, so an app-scoped key can enumerate, update, and delete sibling API keys belonging to the same account that are outside…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56243] Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane…

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56248] Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerab…

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71341] picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle f…

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71365] picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.…

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-71370] picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper func…

picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD