Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47366] Improper verification of access permissions when modifying permissions through the Administration Co…

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

12/06/2026

[CVE-2026-45170] Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and con…

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11933] A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert…

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Crítico vulnerabilidad

12/06/2026

[CVE-2026-35273] Vulnerabilidad explotada activamente en Oracle PeopleSoft Enterprise PeopleTools

CISA confirma explotación activa de una vulnerabilidad en Oracle PeopleSoft Enterprise PeopleTools. Esta vulnerabilidad ha sido utilizada en campañas de ransomware activas. Fecha límite para aplicar parche según directiva CISA: 2026-06-15.

oracleexplotación activavulnerabilidad Ransomware CISA KEV

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42846] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's …

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpre…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-45418] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authentic…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection c…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses…

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45172] Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior…

Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45174] Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potent…

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-49060] Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege E…

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Alto vulnerabilidad

11/06/2026

[CVE-2026-6250] An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to impr…

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, …

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12035] Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacke…

Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-39494] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42647] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-42653] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6.

nvdaltovulnerabilidad CVSS 7.1 NVD

N Alto vulnerabilidad

11/06/2026

[CVE-2026-44249] Netty is a network application framework for development of protocol servers and clients. In netty-h…

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

11/06/2026

[CVE-2026-44250] Netty is a network application framework for development of protocol servers and clients. In netty-c…

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

11/06/2026

[CVE-2026-44890] Netty is a network application framework for development of protocol servers and clients. In netty-c…

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Version…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Crítico vulnerabilidad

11/06/2026

[CVE-2026-12027] Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a…

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD