Alertas de Seguridad de la Información

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48277] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48281] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48283] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-48285] ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF)…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48286] Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-48307] ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XS…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially resulting in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious link. Scope is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-27957] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-14241] Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti…

Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8655] Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredict…

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-8451] Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if N…

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

nvdaltovulnerabilidad CVSS 7.5 NVD

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8452] Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or errone…

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

H Crítico vulnerabilidad

30/06/2026

[CVE-2026-58116] LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit…

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True param…

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58014] A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list fun…

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58016] A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gi…

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

30/06/2026

[CVE-2026-53432] fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line len…

fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

30/06/2026

[CVE-2026-53433] fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --list…

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

30/06/2026

[CVE-2026-44946] A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler di…

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

nvdaltovulnerabilidad CVSS 7.4 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-13474] Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is …

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-10816] Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, …

Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

nvdaltovulnerabilidad CVSS 7.5 NVD