Alertas de Seguridad de la Información

F Alto vulnerabilidad

08/07/2026

[CVE-2026-13128] Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will co…

Embedding JavaScript within a PDF file will cause the page to be deleted. Subsequent scripts will continue to access the relevant properties of the document view, eventually leading to the crash of the application.

nvdaltovulnerabilidad CVSS 7.8 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-55436] Coder allows organizations to provision remote development environments via Terraform. Starting in v…

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true` and only assigned a secure transport when an upstream proxy was configured. In the default configuration (no upstream…

nvdaltovulnerabilidad CVSS 7.4 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55076] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34057] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Project/Database/Import.php) allows client-controlled container and server properties to reach shell commands without locking or validation, allowing an authenticated user to inject commands through a database import conta…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-6900] Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue a…

Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

nvdaltovulnerabilidad CVSS 7.4 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46591] Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J …

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer builds the Cypher WHERE clause for its match/retrieve and delete operations from the CamelNeo4jMatchProperties map. CVE-2025-66169 addressed Cypher injection through the property values by binding them as query parameters ($paramN), but the property names (the JS…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14637] A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd…

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and ma…

nvdaltovulnerabilidad CVSS 8.2 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-8932] libcurl would reuse a previously created connection even when some mTLS config related option had be…

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them m…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

03/07/2026

[CVE-2026-9545] In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it m…

In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLY…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-12413] An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Contin…

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof < elemsof(md->digest)) c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-9563] In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not e…

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-55153] mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c…

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Suc…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-57736] Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded …

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-10513] The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to a…

The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.8.0 via parser-derived 'avatar' and 'url' author metadata. This is due to insufficient input sanitization and output escaping on user-supplied MF2 author properties processed by the unauthenticated webmention REST endpoint and rendered directly into HTML 'value' attributes by the edit…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-27957] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, an authenticated command injection vulnerability in the CA Certificate management feature allows any authenticated user to execute arbitrary commands as the configured SSH user on the managed server host. As the SSH user typically would have to either be root or part of the …

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

30/06/2026

[CVE-2026-44946] A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler di…

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person in the middle attacks against Rancher, affecting Rancher 2.14.0 before 2.14.3,

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13546] A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the f…

A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13515] A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function form…

A security vulnerability has been detected in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56414] A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticate…

A vulnerability exists in H.View IP cameras certificate-related upload interfaces allow authenticated users to store arbitrary file content to fixed, persistent filesystem locations without validating file type, structure, or size. This design omission enables the placement of unexpected or malformed data in locations intended for trusted certificate material, which could affect system integrity o…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55975] A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanit…

A vulnerability exists in H.View IP cameras that could allow an authenticated user to supply unsanitized XML fields to the device's certificate generation interface, which are incorporated into a backend certificate creation command without proper input validation. This may allow for command execution with elevated privileges during certificate generation.

nvdaltovulnerabilidad CVSS 7.2 NVD