Alertas de Seguridad de la Información

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48335] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48336] Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code …

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48275] Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary cod…

Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48287] CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in a…

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

nvdaltovulnerabilidad CVSS 7.4 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48290] CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could…

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction …

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48295] CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that co…

CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attacker could leverage this vulnerability to gain unauthorized read access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46638] Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ…

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46640] Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dyn…

Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

14/07/2026

[CVE-2025-56361] A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifi…

A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic (`emberAfLevelControlClusterServerTickCallback`). When a MoveToLevel command is executed and followed by a conflicting write to the OperationMode attribute (in the Pump Configuration and Control cluster), an invariant check (`minLevel < curr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-61520] Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-…

Simple Machines Forum 2.1 prior to commit 4bf35cf and 3.0 prior to commit b4d23df contains a server-side request forgery vulnerability in the image proxy that allows authenticated attackers to trigger internal HTTP requests by embedding attacker-controlled URLs in BBCode image tags, which the proxy fetches without validating resolved destination IPs against private address ranges, loopback, or lin…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-52100] Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a …

Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary code via the uploadPutHandler function

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49477] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49853] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHT…

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49855] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip …

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, Tornado gzip decompression routines processed limited-size chunks but did not enforce an overall limit on accumulated decompressed chunks, allowing a malicious server accessed by SimpleAsyncHTTPClient or an HTTPServer configured with decompress_request=True to consume effectively unlimited memory. This issue is …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48370] Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary cod…

Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-48815] sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, th…

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized cer…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

14/07/2026

[CVE-2026-49476] Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the …

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a re…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48341] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48342] Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary…

Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-48343] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD