Alertas de Seguridad de la Información

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57770] Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all…

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57738] Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Inject…

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57744] Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a…

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57724] Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This …

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57713] Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manage…

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57371] Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object In…

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-58281] Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker…

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-44795] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, …

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3,…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

10/07/2026

[CVE-2026-54469] Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untruste…

Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-59827] Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59…

Metabase is an open-source business intelligence and embedded analytics tool. Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation, allowing an authenticated user who can run native H2 queries to execu…

nvdcriticovulnerabilidad CVSS 9.9 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-54499] Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of…

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.12.2, Stanza model loaders such as stanza.models.common.pretrain.Pretrain.load() attempt torch.load(..., weights_only=True) but fall back to torch.load(..., weights_only=False) on attacker-controllable pickle.UnpicklingError, allowing a malicious .pt pretrain or mod…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

07/07/2026

[CVE-2026-33264] A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro…

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Us…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43825] Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M…

Untrusted Java Deserialization in Apache OpenNLP SvmDoccatModel Versions Affected:   before 3.0.0-M4 (libsvm document categorization module; introduced in   OPENNLP-1808 and only present on the 3.x line) Description: SvmDoccatModel.deserialize(InputStream) reads an attacker-controlled stream with java.io.ObjectInputStream and calls readObject() without an ObjectInputFilter installed. ObjectInput…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46590] Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc compon…

Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadata back from the configured secret backend by deserializing a Base64-wrapped value with a raw java.io…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-43867] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc compon…

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-40859] Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component des…

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is config…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-42527] Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter patt…

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject meth…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43865] Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-haze…

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean is provided - neither Haz…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43866] Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBin…

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 h…

nvdaltovulnerabilidad CVSS 7.3 NVD