Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46870] Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The suppo…

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). S…

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46851] Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone…

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft E…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46776] Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Co…

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified Directory. Successful attacks of this vulnerability can result in unauthorized creation, deletion or…

nvdaltovulnerabilidad CVSS 8.6 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35279] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: P…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of Peopl…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35275] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folder…

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significa…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-47747] stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wa…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the BINUNICODE opcode handler. The issue was caused by sign confusion on the opcode length field. A crafted .ckpt file coul…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-47750] stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wa…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. In versions prior to master-584-0a7ae07, the pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the GLOBAL opcode handler. The issue was caused by missing validation when searching for newline-delimited fields. A craft…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

16/06/2026

[CVE-2026-0156] In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missi…

In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53864] OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environmen…

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious Node.js control variables to influence child processes or coverage output paths.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53865] OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that …

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53858] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .e…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53842] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53843] OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-s…

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53846] OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows …

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-47749] stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wa…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode ha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-44932] Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 co…

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-10649] A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vu…

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-48780] Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously craft…

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email ad…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12398] A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the lega…

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution o…

nvdaltovulnerabilidad CVSS 7.5 NVD