Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50131] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify pre…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete.…

nvdaltovulnerabilidad CVSS 8.6 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46669] OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior t…

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patche…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46679] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three co…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-46522] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

T Alto vulnerabilidad

10/06/2026

[CVE-2026-42542] TDengine is an open source, time-series database optimized for Internet of Things devices. In versio…

TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single crafted RPC packet. No credentials or prior session state are required. Version 3.4.1.6 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-44692] Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sha…

Sharp is a content management framework built for Laravel as a package. Prior to version 9.22.0, Sharp exposes a generic download endpoint that authorizes access only to the supplied Sharp entity instance, but then reads the target storage disk and path from request parameters. Because the requested storage object is not bound to the authorized entity instance, an authenticated Sharp user who can …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-2049] GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerabi…

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of HDR files. The issue results f…

nvdaltovulnerabilidad CVSS 7.8 NVD

P Crítico vulnerabilidad

10/06/2026

[CVE-2026-0274] An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Corte…

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.

nvdcriticovulnerabilidad CVSS 9.1 NVD

D Alto vulnerabilidad

10/06/2026

[CVE-2026-10142] kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that a…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memor…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

10/06/2026

[CVE-2026-10143] kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handl…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validati…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0271] A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux…

A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to execute code with elevated privileges. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0273] A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad…

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0270] A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux …

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2022-26758] A malicious application may cause unexpected changes in memory shared between processes. A memory co…

A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-6893] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This all…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46529] Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si…

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PD…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

10/06/2026

[CVE-2026-1220] Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit …

Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-50637] Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injectio…

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the contents of the metric names or values. If the names have newlines and statsd control characters (colon, pipe) then metric injections are possible. V…

nvdaltovulnerabilidad CVSS 8.2 NVD

P Crítico vulnerabilidad

10/06/2026

[CVE-2026-50638] Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injec…

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapter::DogStatsd which extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability. In addition, the _tags function does not check tags f…

nvdcriticovulnerabilidad CVSS 9.1 NVD