Alertas de Seguridad de la Información

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15122] Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871…

Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10037] A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME hand…

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, an…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59724] Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

06/07/2026

[CVE-2026-54234] vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-49042] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46587] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46588] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55994] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange).…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55993] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache …

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value was the plain string QUERY (and RETURN_LUCENE_DOCS for HEADER_RETURN_LUCENE_DOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderF…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa…

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operat…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46726] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (VertxWebsocketConsumer.populateExchangeHeaders()). Be…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46457] Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component ma…

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy() with no inbound rules configured (NatsConfiguration). With no inFilter, inFilterPattern or inFilterStartsWith set, DefaultHeaderFilterStrategy.applyFilterToExter…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14637] A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd…

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and ma…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58292] Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exec…

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57985] Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to exec…

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-13341] A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.…

A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

nvdaltovulnerabilidad CVSS 7.4 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-54405] A malicious actor with access to the network could exploit an Improper Input Validation vulnerabilit…

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Denial of Service (DoS) attack on the application.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14428] Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.4…

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14429] Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a…

Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD