Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13753] A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Pri…

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-48614] An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject …

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48316] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40140] BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication v…

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

nvdaltovulnerabilidad CVSS 7.5 NVD

B Crítico vulnerabilidad

06/07/2026

[CVE-2026-40141] A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support an…

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated attacker with limited privileges to access unintended resources or data beyond their authorization scope. Exploitation is restricted to accounts…

nvdcriticovulnerabilidad CVSS 9.9 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43825] Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M…

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInput…

nvdaltovulnerabilidad CVSS 7.3 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40138] A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Re…

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configur…

nvdaltovulnerabilidad CVSS 8.1 NVD

B Crítico vulnerabilidad

06/07/2026

[CVE-2026-40139] A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Re…

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53831] DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and s…

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 t…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-5268] An authentication bypass vulnerability exists in the default SFTP server component utilized across t…

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation could allow an attacker to read or modify system files.

nvdcriticovulnerabilidad CVSS 9.1 NVD

P Alto vulnerabilidad

06/07/2026

[CVE-2026-59194] pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside …

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

06/07/2026

[CVE-2026-59195] pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lock…

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm…

nvdaltovulnerabilidad CVSS 8.2 NVD

P Alto vulnerabilidad

06/07/2026

[CVE-2026-59196] pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined dir…

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53829] ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to versio…

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2025-53830] Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing …

Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud before 1.2.3 are vulnerable to Server-Side Request Forgery (SSRF). This corresponds to versions of ownCloud 10 prior to 10.15.3. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade Anti-Virus for ownCloud 10 to version 1.2.3 or later t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2025-53827] ownCloud Core is the server-side component of the file storage, synchronization, and sharing applica…

ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Updater on ownCloud 10 before 10.15.3 has an exposed dangerous method or function. Attackers with administrative privileges may leverage functionality to execute arbitrary code. This issue has been fixed in version 10.15.3.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53828] SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronizatio…

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 1…

nvdaltovulnerabilidad CVSS 8.5 NVD

G Alto vulnerabilidad

06/07/2026

[CVE-2026-58380] A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pn…

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

06/07/2026

[CVE-2026-13698] A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2…

A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13705] Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SG…

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left…

nvdaltovulnerabilidad CVSS 7.1 NVD