Alertas de Seguridad de la Información

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48287] CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in a…

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

nvdaltovulnerabilidad CVSS 7.4 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48346] Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code ex…

Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15515] A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects …

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown processing in the library qmudisk64.sys of the component QMUDisk Driver. The manipulation leads to uncontrolled search path. The attack must be carried out locally. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been disclo…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-49145] App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.…

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Versi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-6901] Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APR…

Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57919] PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\P…

PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated users. A low-privileged local attacker can connect to this pipe and send crafted IPC messages to trigger execution of arbitrary commands with SYSTEM privileges via an untrusted search path. This allows…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

26/06/2026

[CVE-2026-46710] Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a…

Notepad++ is a free and open-source source code editor. From 8.9.4 until 8.9.6, Notepad++ contains a local privilege escalation vulnerability in the installer. During installation, the installer invokes powershell.exe without using an absolute path after setting the working directory to the installation contextMenu directory. If an attacker can pre-place a malicious powershell.exe in a user-writab…

nvdaltovulnerabilidad CVSS 7.8 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53865] OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that …

OpenClaw before 2026.5.2 contains a path traversal vulnerability in maintenance task execution that allows workspace-derived service paths to influence trash command selection. Attackers can execute unintended local executables from operator-unintended paths during maintenance operations by manipulating workspace-derived environment paths.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53858] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .e…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53842] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53846] OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows …

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53819] OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows …

OpenClaw before 2026.5.27 contains an arbitrary code execution vulnerability in skill install flows where workspace .env files can override the Homebrew executable selection. Attackers with access to trusted operator workspaces can execute unintended Homebrew-compatible executables during skill setup to compromise the system.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48565] Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privilege…

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47648] Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally…

Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-24064] Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerab…

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLD_INSERT_LIBRARIES environment variable to inject an attacker-controlled dynamic library into the trusted client process…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11400] An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amaz…

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through an affected wrapper. To remediate th…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11401] An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon…

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL will allow a remote authenticated low-privilege actor to escalate privileges to those of another Amazon RDS user, including rds_superuser, via a crafted function created by the actor that runs when that user connects to the cluster through the affected wrapper. To remediate thi…

nvdaltovulnerabilidad CVSS 8.0 NVD