Alertas de Seguridad de la Información

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50083] The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is …

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50084] The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer…

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of a…

nvdcriticovulnerabilidad CVSS 9.6 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-47691] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.…

nvdaltovulnerabilidad CVSS 8.7 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-48006] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelIna…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-48059] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the succ…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-48748] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45833] A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a…

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45830] A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows …

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45831] The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaD…

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45832] All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database…

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6211] Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc.…

Unrestricted upload of file with dangerous type vulnerability in Global IT Informatics Services Inc. WEOLL allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WEOLL: from 2.0.9 before 3.2.45.33.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-6853] Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe …

Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry and Trade Ltd. Co. Pause+ Mobile App allows Authentication Bypass. This issue affects Pause+ Mobile App: from v1.0.6 before v1.5.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-7368] The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid c…

The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all robots globally, and can publish to any robot's command topic using only the robot's serial number (disclosed in the telemetry stream). Even after removal of hard-c…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-53721] Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 a…

Nuxt is an open-source web development framework for Vue.js. From versions 3.11.0 to before 3.21.7 and 4.0.0 to before 4.4.7, there is a route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher. This issue has been patched in versions 3.21.7 and 4.4.7.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-53787] Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary fil…

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without authentication, session validation, or cart context. Attackers can upload PHP files to achieve remote code execu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

J Crítico vulnerabilidad

12/06/2026

[CVE-2026-54133] jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem…

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into gener…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47210] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerabilit…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI (WebAssembly.promising / WebAssembly.Suspending). In the tested configuration, a JSPI-backed Promise can reach Promise.prototype.finally() in a way th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47135] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47137] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gw…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality (options.require === false), which is trivially bypassed by omitting the require option entirely. When require is not specified, options.re…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47139] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding pub…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when th…

nvdaltovulnerabilidad CVSS 8.6 NVD