Alertas de Seguridad de la Información

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50627] The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of inc…

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50628] A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres…

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11845] The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injecti…

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11846] The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File D…

The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories,  resulting in data destruction or service disruption.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-12059] The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, all…

The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers to bypass the enforced command restrictions and execute operating system commands outside the originally authorized scope.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-44892] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure defa…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

12/06/2026

[CVE-2026-45169] Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, an…

Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 exhibit a validation vulnerability. Under specific circumstances and configuration scenarios, processing unexpected input could potentially lead to an unexpected service termination, resulting in a localized denial of service (DoS). CyberArk Security Bulletin: CA26-17

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47367] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47368] A malicious actor with access to the network could exploit a Path Traversal vulnerability found in c…

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47369] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47370] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-48610] Under certain network configurations, a malicious actor with access to network could exploit an Impr…

Under certain network configurations, a malicious actor with access to network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47365] Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows …

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11933] A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert…

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Crítico vulnerabilidad

12/06/2026

[CVE-2026-35273] Vulnerabilidad explotada activamente en Oracle PeopleSoft Enterprise PeopleTools

CISA confirma explotación activa de una vulnerabilidad en Oracle PeopleSoft Enterprise PeopleTools. Esta vulnerabilidad ha sido utilizada en campañas de ransomware activas. Fecha límite para aplicar parche según directiva CISA: 2026-06-15.

oracleexplotación activavulnerabilidad Ransomware CISA KEV

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42846] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's …

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpre…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses…

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45172] Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior…

Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host. CyberArk Security Bulletins: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45174] Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potent…

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization. CyberArk Security Bulletin: CA26-19

nvdaltovulnerabilidad CVSS 7.8 NVD