Alertas de Seguridad de la Información

R Alto vulnerabilidad

11/06/2026

[CVE-2026-49982] tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a…

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.proto…

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-49218] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-48110] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several r…

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt t…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46669] OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior t…

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patche…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46679] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three co…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45062] FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the…

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can plac…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45565] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block…

nvdaltovulnerabilidad CVSS 8.1 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45329] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machi…

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34712] CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Imprope…

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47931] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47930] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-9211] An unauthenticated user on the local network can gain control of the router and make unauthorized ch…

An unauthenticated user on the local network can gain control of the router and make unauthorized changes to its operation.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-9212] Insufficient authentication and input validation in the listed NETGEAR models allow users connected …

Insufficient authentication and input validation in the listed NETGEAR models allow users connected to the local network to execute commands impacting the product's confidentiality or change certain configurations.

nvdaltovulnerabilidad CVSS 8.0 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-9213] A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercep…

A vulnerability in the affected NETGEAR gaming routers allows attackers with the ability to intercept and tamper with traffic between the router and the Internet, to execute code on the device.

nvdaltovulnerabilidad CVSS 8.1 NVD

F Alto vulnerabilidad

09/06/2026

[CVE-2026-49475] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds me…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48569] Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security…

Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45636] Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44811] Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate priv…

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-40376] Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privilege…

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD