Alertas de Seguridad de la Información

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57301] Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rathe…

Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

24/06/2026

[CVE-2026-57281] Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformat…

Jenkins Script Security Plugin 1402.v94c9ce464861 and earlier does not reject Groovy AST transformation annotations carrying an extensions member, allowing attackers able to run sandboxed Groovy scripts to execute code outside the sandbox if a suitable script is present on the classpath of the component that evaluates the script.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56245] Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINE…

Supabase Capgo before 12.128.2 contains an authorization bypass vulnerability in the SECURITY DEFINER record_build_time RPC function that allows unauthenticated attackers to insert arbitrary build-time records. Attackers can exploit this by calling POST /rest/v1/rpc/record_build_time with a public API key to poison billing and quota data for any organization, enabling resource exhaustion and cross…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56256] Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive O…

Capgo before 12.128.2 enforces mandatory two-factor authentication only at the UI level. Sensitive Organization (ORG) management API endpoints (e.g., editing organization details, inviting users) do not validate 2FA completion on the backend. An authenticated Admin user who has not enabled 2FA can replay or modify a previously captured ORG API request to perform privileged organization actions, by…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56231] Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST …

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder comma…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56052] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

nvdaltovulnerabilidad CVSS 7.6 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52934] In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversi…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tvlv: reject oversized TVLV packets batadv_tvlv_container_ogm_append() builds a TVLV packet section from the tvlv.container_list. The total size of this section is computed by batadv_tvlv_container_list_size(), which sums the sizes of all registered containers. The return type and accumulator in batadv_tvlv_containe…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52935] In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an…

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that state through espintcp_push_msgs(). For blocking callers, espintcp_push_msgs() may return success even when the previous partial send is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9709] The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST …

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields. This affects the premium co Cornerstone page builder distributed bundled with the X , not the unrelated free `cornerstone` Cornerstone W…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-54639] Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulne…

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability starting in version 4.3.0 and prior to version 5.4.4. Impact users have: direct usage of `convertTokenData(tokens, { output: 'object' });`; indirect usage, via using Expand API; and/or indirect usage via SD's transform lifecycle. Impact is high for this when style-dictionary is used as an i…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

23/06/2026

[CVE-2026-54513] jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson …

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTyp…

nvdaltovulnerabilidad CVSS 8.1 NVD

H Alto vulnerabilidad

23/06/2026

[CVE-2026-54317] Home Assistant is open source home automation software that puts local control and privacy first. Pr…

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configura…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54018] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the SafePlaywrightURLLoader implements a validate_url function to prevent SSRF attacks by checking the IP address of the user-provided URL. However, this validation is performed only on the initial URL. Since Playwright automatically follows HTTP redirects (301/302) by default, an att…

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54010] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach arbitrary file_id values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, has_access_to_file() treats the victim file as accessible…

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54011] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6,Open WebUI renders Mermaid blocks from Markdown files in the file preview panel and inserts the generated SVG into the DOM using innerHTML. Because Mermaid is configured with securityLevel: 'loose', attacker-controlled Mermaid content can be rendered unsafely in this flow. A working pa…

nvdaltovulnerabilidad CVSS 8.7 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54012] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in …

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54013] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI patched SVG XSS in user profile images and webhook profile images but forgot to apply the same fix to model profile images. The ModelMeta class has no validate_profile_image_url field validator, and the model image serving endpoint has no MIME allowlist or nosniff header. A…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54008] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, backend/open_webui/utils/oauth.py::_process_picture_url calls validate_url(picture_url) on the initial URL only, then invokes aiohttp.ClientSession.get(picture_url, ...) without allow_redirects=False. aiohttp's default is allow_redirects=True, max_redirects=10; the function does not p…

nvdaltovulnerabilidad CVSS 8.5 NVD

A Alto vulnerabilidad

23/06/2026

[CVE-2020-9695] Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier a…

Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

23/06/2026

[CVE-2026-55446] Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an a…

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.0.19, an attacker can send a /api/v1/files/upload/ request without any authentication token/cookies and abuse a very long multipart form boundary to make the langflow app unusable for all users for an indefinite amount of time. This vulnerability is fixed in 1.0.19.

nvdaltovulnerabilidad CVSS 7.5 NVD