Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40994] Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that i…

Wss4jSecurityInterceptor initialized its BSP (WS-I Basic Security Profile) compliance flag so that inbound validation disabled WSS4J BSP enforcement on RequestData. Services that validate WS-Security on the network could therefore accept messages that violate BSP rules, weakening protocol-level checks. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40999] When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate o…

When WS-Addressing is used with non-anonymous ReplyTo or FaultTo addresses, Spring WS may initiate outbound connections through configured WebServiceMessageSender instances to destinations taken directly from request headers without verifying that those destinations are safe to connect to. Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-10795] The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication B…

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a p…

nvdaltovulnerabilidad CVSS 8.1 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-53460] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, a missing check for maximum memory request in AcquireAlignedMemory could trigger an out-of-Memory condition. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-53461] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-50 and 7.1.2-25, an incorrect loop in the ICON decoder can result in an out of bounds heap write resulting in a crash. This issue has been patched in versions 6.9.13-50 and 7.1.2-25.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-49218] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42305] Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting wit…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Cont…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-46520] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, when reading multiple images with different dimensions an out of bounds heap write can occur. This issue has been patched in versions 6.9.13-48 and 7.1.2-23.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-46522] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

10/06/2026

[CVE-2026-10142] kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that a…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in the protocol parser that allows a malicious broker or machine-in-the-middle attacker to exhaust memory or hang connections by sending a crafted 4-byte frame length value without bounds validation. Attackers can send a specially crafted frame length through the receive_bytes() function to trigger either a multi-gigabyte memor…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

10/06/2026

[CVE-2026-10143] kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handl…

kafka-python prior to 2.3.2 contains a denial-of-service vulnerability in SCRAM authentication handling that allows a malicious or machine-in-the-middle broker to freeze the client event loop by supplying an excessively large iteration count. In scram.py, ScramClient.process_server_first_message() passes the broker-controlled SCRAM iteration count directly to hashlib.pbkdf2_hmac() without validati…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0272] A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated …

A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CLI) to perform actions on the device with root privileges. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators and by restricting access to the management inte…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0273] A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated ad…

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI or Web UI. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administ…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0270] A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux …

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50570] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability c…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-11417] OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.…

OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to co…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2026-25700] Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affect…

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixe…

nvdaltovulnerabilidad CVSS 7.2 NVD

K Alto vulnerabilidad

10/06/2026

[CVE-2026-53473] A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent w…

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link in the user interface, the embedded malicious code executes within the user's browser session. This cross-site scripting (XSS) vulnerability allows the attacker to compromise the victim's R…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45564] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.system(f"dos2unix -q {cfg}"). configver is not run through EscapedString (Pydantic doesn't validate path segments declar…

nvdaltovulnerabilidad CVSS 8.8 NVD