Alertas de Seguridad de la Información

C Alto vulnerabilidad

07/07/2026

[CVE-2026-44454] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) cou…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-23698] Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin …

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents directly into the modules/ directory under the web root without validating file types beyond the manife…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-57851] MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys ker…

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator privileges. Attackers can exploit the accessible device object through IOCTL handlers to manipulate kernel …

nvdaltovulnerabilidad CVSS 7.8 NVD

E Alto vulnerabilidad

07/07/2026

[CVE-2026-13020] A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions …

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-23697] Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileg…

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code through the Documents module, bypassing the extension denylist in config.inc.php which omits the .phar extension. The uploaded file is stored with its original .phar extension under the web-accessible s…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

07/07/2026

[CVE-2026-56811] Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoe…

Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauthenticated attacker to cause a denial of service against any endpoint that mounts a Phoenix socket with a reachable channel transport (WebSocket or LongPoll). This vulnerability is associated with program files lib/phoenix/socket.ex and program routine 'Elixir.Phoe…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

07/07/2026

[CVE-2026-56812] Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Pres…

Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. This vulnerability is associated with program files assets/js/phoenix/presence.js and program routines Presence.syncState and…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-44938] A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-se…

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.options.namespaceLabels) when applying them to the target namespace. An attacker with git push access to a Fleet-monitored repository could overwrite Pod Security Standards (PSS) enforcement labels on a target namespace.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-14476] A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() funct…

A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to auth…

nvdaltovulnerabilidad CVSS 8.0 NVD

G Alto vulnerabilidad

07/07/2026

[CVE-2026-58384] A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an unders…

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-42200] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution thr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34168] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a storage name containing shell metacharacters and execute commands on managed servers when the resource is …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34058] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without any sanitization or escaping. This parameter is interpolated directly into shell commands e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

06/07/2026

[CVE-2026-21383] Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requir…

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-13753] A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Pri…

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40140] BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication v…

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53831] DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and s…

DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 t…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53829] ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to versio…

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2025-53828] SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronizatio…

SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint for ownCloud prior to version 0.4.1, which corresponds to ownCloud 10 prior to 10.15.3, an attacker with administrative privileges can use a SSRF vulnerability in the SharePoint app to execute arbitrary code on the system. Upgrade ownCloud 1…

nvdaltovulnerabilidad CVSS 8.5 NVD