Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-57102] Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize…

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55487] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stri…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55697] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/-

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55698] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap m…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager loc…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56447] MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbit…

MISP allowed an authenticated site administrator to set the Kafka_rdkafka_config setting to an arbitrary filesystem path. MISP subsequently parsed the referenced INI file and passed its options to rdkafka. A crafted attacker-controlled configuration file could use rdkafka options such as plugin.library.paths to load an external library, resulting in arbitrary code execution with the privileges of …

nvdaltovulnerabilidad CVSS 7.2 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44691] In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/t…

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/s…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-46580] In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a…

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indir…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44688] In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory …

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt inj…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

17/06/2026

[CVE-2026-22283] Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from U…

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-42089] Yeoman Environment provides an API to discover, create, and run generators, and to configure where a…

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package install…

nvdaltovulnerabilidad CVSS 8.6 NVD

F Alto vulnerabilidad

15/06/2026

[CVE-2026-12057] When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails…

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

nvdaltovulnerabilidad CVSS 8.6 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53810] OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extensio…

OpenClaw before 2026.5.18 contains a code execution vulnerability where marketplace runtime extension metadata can redirect loading toward unscanned package payloads. Attackers with trusted operator access can manipulate extension metadata to load plugin code outside reviewed package entry points, bypassing security scanning.

nvdaltovulnerabilidad CVSS 8.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52858] Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi…

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46529] Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A si…

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PD…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47292] Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize…

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11269] Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attack…

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.1 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2026-8879] Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content sc…

Version 3.0.7 of the Securly Chrome Extension dynamically registers content13.min.js as a content script via chrome.scripting.registerContentScripts() at runtime. This script is NOT declared in manifest.json and bypasses Chrome Web Store static security review. It runs on all URLs and immediately hides all page content, creates a full-page overlay, pauses all videos, and only restores content when…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2022-49042] An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in …

An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

03/06/2026

[CVE-2022-49036] An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration i…

An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creator before 2.5.0-2081 allows local users to execute arbitrary code via unspecified vectors.

nvdaltovulnerabilidad CVSS 7.8 NVD