Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

30/06/2026

[CVE-2026-49451] The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common s…

The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. From 2.0.0-preview11 until 2.7.5 and 3.5.4, a small OpenAPI document containing a circular schema reference can cause process termination through stack overflow in Microsoft.OpenApi. The issue affects OpenAPI document parsing …

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48313] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require us…

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48315] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires …

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48276] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48277] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48281] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48283] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

A Alto vulnerabilidad

30/06/2026

[CVE-2026-48285] ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF)…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48286] Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

A Alto vulnerabilidad

30/06/2026

[CVE-2026-48307] ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XS…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is…

M Alto vulnerabilidad

30/06/2026

[CVE-2026-27957] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the …

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-14241] Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti…

Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8655] Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredict…

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

C Alto vulnerabilidad

30/06/2026

[CVE-2026-8451] Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if N…

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8452] Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or errone…

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

H Crítico vulnerabilidad

30/06/2026

[CVE-2026-58116] LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit…

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True param…

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58014] A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list fun…

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58016] A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gi…

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s…

J Alto vulnerabilidad

30/06/2026

[CVE-2026-53432] fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line len…

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?