Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

22/06/2026

[CVE-2025-71344] picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_p…

picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing attackers to execute arbitrary code. Malicious pickle files embedding ensurepip._run_pip calls in __reduce__ methods bypass picklescan detection and achieve remote code execution upon pickle.load() invocation.

M Alto vulnerabilidad

22/06/2026

[CVE-2025-71358] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.Au…

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims using pickle.load().

C Alto vulnerabilidad

22/06/2026

[CVE-2026-55603] http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequest…

http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart …

D Alto vulnerabilidad

22/06/2026

[CVE-2026-44271] Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of …

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

D Alto vulnerabilidad

22/06/2026

[CVE-2026-44272] Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of …

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

D Alto vulnerabilidad

22/06/2026

[CVE-2026-44274] Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Be…

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54299] Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 …

Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the f…

N Alto vulnerabilidad

22/06/2026

[CVE-2026-54293] NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials s…

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() deco…

M Alto vulnerabilidad

22/06/2026

[CVE-2026-53779] WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthe…

WebP Server Go through 0.14.4 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to read files outside the configured IMG_PATH directory by sending requests with percent-encoded backslashes (%5C) that bypass the path.Clean() sanitization in handler/router.go. Attackers can exploit the discrepancy between Go's forward-slash-only path normalization and Windows f…

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50146] Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts …

Astro is a web framework. Prior to 6.3.3, when a component uses a client:* directive, Astro inserts named slot content into a data-astro-template attribute without HTML escaping the slot name allowing an attacker to break out of the attribute context and inject arbitrary HTML, resulting in reflected XSS during SSR. This vulnerability is fixed in 6.3.3.

C Alto vulnerabilidad

22/06/2026

[CVE-2026-55602] http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, …

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+pat…

M Alto vulnerabilidad

22/06/2026

[CVE-2026-54290] Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.…

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.25, with credentials: true and no explicit origin (the default wildcard), the CORS Middleware reflects the request's Origin and sends Access-Control-Allow-Credentials: true. Any site can then make credentialed cross-origin requests and read the responses, exposing cookie-authenticated endpoints to a…

M Alto vulnerabilidad

22/06/2026

[CVE-2026-55388] piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's co…

piscina is a node.js worker pool implementation. Prior to 6.0.0-rc.2, 5.2.0, and 4.9.3, piscina's constructor and run() paths read the filename option via plain member access. Both reads fall through the prototype chain when the caller's options object doesn't have filename as an own property. When Object.prototype.filename is polluted upstream the inherited value flows to worker_threads.Worker im…

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54275] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have bee…

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54277] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS…

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54278] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, dur…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in …

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54279] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, hos…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54280] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, pay…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is…

E Alto vulnerabilidad

22/06/2026

[CVE-2026-54283] Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts ma…

Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields…

P Alto vulnerabilidad

22/06/2026

[CVE-2026-54271] protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix …

protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.3.2 and 2.5.0, a previous fix for unsafe name handling in pbjs static / static-module code generation was incomplete. Affected versions of protobufjs-cli could still emit unsafe JavaScript references when generating static output from crafted JSON descriptor input. The common case of parsing schemas from .proto files is not affe…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?