Alertas de Seguridad de la Información

J Alto vulnerabilidad

30/06/2026

[CVE-2026-53433] fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --list…

fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage during request handling.This allows a single malicious request to monopolize the single…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-13474] Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is …

Denial of service via malformed HTTP/2 requests in NetScaler ADC and NetScaler Gateway if HTTP/2 is enabled in HTTP Profile and associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-10816] Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, …

Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-10817] Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if t…

Insufficient input validation leading to memory overread in NetScaler ADC and NetScaler Gateway if the TCP TimeStamp is enabled in TCP Profile and is associated with the virtual server (of type LB, CS, VPN) or the service configured on NetScaler

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-57080] Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-…

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, while receive_data appends every inbound byte to the input buffer. A peer announces a length prefix of up to about 4 GiB and then streams bytes; the d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-57081] Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested ben…

Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by value while the list and dictionary branches capture the whole remainder, so every live recursion frame keeps its own copy of the shrinking buffer (O(N^…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-14161] Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo…

Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

30/06/2026

[CVE-2026-41053] Incorrect authentication caching in the team member ship expansion of the Rancher Github authenticat…

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-53916] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-53917] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issu…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-54475] Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.…

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache A…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49432] Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Sto…

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to caus…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49877] Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console…

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the is…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-50734] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-50750] Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache…

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-8141] The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t…

The Ajax Load More - Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'taxonomy_include_children' parameter in all versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

30/06/2026

[CVE-2025-7406] Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker …

Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The risk can be temporarily mitigated by restricting the set of commands permitted v…

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

30/06/2026

[CVE-2025-24815] Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file t…

Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-14164] A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially c…

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56137] RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerabili…

RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. contain an OS command injection vulnerability. If a user loads a specially crafted save-file, arbitrary OS command may be executed.

nvdaltovulnerabilidad CVSS 7.8 NVD