Alertas de Seguridad de la Información

G Alto vulnerabilidad

17/06/2026

[CVE-2026-28615] In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions byp…

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12360] The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and includin…

The JetEngine plugin for WordPress is vulnerable to SQL injection in all versions up to and including 3.8.10.1. The listing_load_more AJAX handler accepts a filtered_query parameter that is intentionally excluded from the HMAC query signature check to support front-end filter integration. However, meta_query row values within filtered_query are not sanitized before being merged into SQL constructi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12199] A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown…

A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (`/SHUTDOWN%20THE%20SERVER`) to terminate the process immediately via `os._exit(0)`. This results in a denial of service, impacting se…

nvdaltovulnerabilidad CVSS 7.5 NVD

T Alto vulnerabilidad

17/06/2026

[CVE-2026-11409] An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler i…

An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

T Alto vulnerabilidad

17/06/2026

[CVE-2026-11410] An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configurat…

An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges.

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-0068] In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC…

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69136] Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.

Unauthenticated Local File Inclusion in Wanium

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69117] Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

Unauthenticated Local File Inclusion in Ingenioso

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-60085] Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.

Unauthenticated Local File Inclusion in Learnify

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2025-48643] In multiple locations there is a possible provisioning bypass due to improper input validation. This…

In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2024-49269] Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions.

Unauthenticated Cross Site Scripting (XSS) in my flatonica

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46974] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The …

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impa…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46965] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover of …

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46966] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. Successful attacks of this vulnerability can result in takeover o…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46938] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Plan…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Ba…

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46940] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Plan…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Bas…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46942] Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suit…

Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Process Planning. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46925] Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel C…

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applicatio…

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46929] Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Plan…

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Bas…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46873] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device…

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significa…

nvdaltovulnerabilidad CVSS 7.5 NVD