Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50306] Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50307] Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50301] Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code local…

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-4017] Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with lo…

Buffer Overflow in the entry handler of the TraceEvent() system call could allow an attacker with local access to cause information disclosure, data tampering or a crash of the QNX Neutrino kernel.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48309] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48365] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48368] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47642] Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47967] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47968] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45077] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist,…

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45756] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause …

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47290] Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47295] Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a…

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45074] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can r…

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15747] Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CS…

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed…

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59886] pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its manti…

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to co…

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-59891] sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, ge…

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for an…

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58640] Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58647] Improper neutralization of input during web page generation ('cross-site scripting') in Power BI all…

Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?