Alertas de Seguridad de la Información

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17643] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain …

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17644] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain un…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17646] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated atta…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper restriction of XML external entity references.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17647] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to execute arbitrary commands due to the inclusion of functionality from an untrusted control sphere.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17618] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated at…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19546] A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.…

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

21/07/2026

[CVE-2026-59851] A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does no…

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

07/07/2026

[CVE-2026-58384] A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an unders…

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

06/07/2026

[CVE-2026-58380] A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pn…

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

01/07/2026

[CVE-2026-5136] A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignme…

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege es…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58014] A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list fun…

A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-58016] A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gi…

A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of s…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

29/06/2026

[CVE-2026-12856] A flaw was found in the vscode-java extension, which provides Java language support for Visual Studi…

A flaw was found in the vscode-java extension, which provides Java language support for Visual Studio Code. The extension incorrectly trusts all Markdown content in JavaDoc hovers, allowing a malicious Java file to include hidden commands. If a user clicks a specially crafted link within a JavaDoc hover popup, an attacker can execute arbitrary VS Code commands, which can lead to full system compro…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

29/06/2026

[CVE-2026-13601] A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation pr…

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML in…

nvdaltovulnerabilidad CVSS 7.1 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-13325] A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set…

A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-11800] A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr…

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized acces…

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-12975] A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParse…

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via ex…

nvdaltovulnerabilidad CVSS 8.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-12992] A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without di…

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forger…

nvdaltovulnerabilidad CVSS 7.4 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-9800] A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to by…

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-9086] A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those w…

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-S…

nvdaltovulnerabilidad CVSS 7.3 NVD