Alertas de Seguridad de la Información

H Alto vulnerabilidad

18/06/2026

[CVE-2026-55204] HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability i…

HAProxy through 3.4.0, fixed in commit 9a6d1fe, contains a null pointer dereference vulnerability in hpack_dht_insert() within src/hpack-tbl.c that fails to validate the return value of hpack_dht_defrag() when the memory pool is exhausted. An attacker can trigger HPACK dynamic table insertions under memory pressure to dereference a NULL pointer and crash HAProxy worker processes, causing denial o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-55237] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticat…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-30799] Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plu…

Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.*, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-30802] Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This …

Out-of-bounds Read vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0, from 2.4.5 before 2.4.*.

nvdaltovulnerabilidad CVSS 8.2 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-2674] Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professio…

Out-of-bounds Write, Out-of-bounds Write, Out-of-bounds Write vulnerability in RTI Connext Professional (Queueing Service,Core Libraries,Persistence Service) allows Overflow Buffers, Overflow Buffers, Overflow Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*.

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-2467] Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflo…

Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.0.0 before 5.2.*.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69126] Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

Unauthenticated Local File Inclusion in Fortius

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48788] Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can a…

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and re-serves the response from Remark42's own origin. During the download phase, the proxy determines whe…

nvdaltovulnerabilidad CVSS 8.2 NVD

G Alto vulnerabilidad

16/06/2026

[CVE-2026-0133] In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootc…

In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-46331] In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial CO…

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-53703] A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a R…

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file, the demuxer parses MDPR (media properties) chunks to configure audio streams. For audio stream header versions 4 and 5, the parser reads fields such as codec type, packet size, sample rate, channel count, and extra codec data length from fixed offsets within the chunk without fi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49954] Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that al…

Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-45389] In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate pro…

In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificates that are not meant for client authentication (because of KeyUsage and ExtendedKeyUsage).

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-6040] A heap use-after-free existed when importing the blank-width characters of an ODF number format. A p…

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed versions the position is bounds-checked before use.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49064] Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve E…

Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12218] A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function S…

A vulnerability was detected in Yealink SIP-T46U 108.87.50.1. The affected element is the function StartReportInformation of the file /api/inner/beforewifitest of the component Web FastCGI Service. The manipulation of the argument port results in stack-based buffer overflow. Access to the local network is required for this attack. The exploit is now public and may be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 8.0 NVD

P Alto vulnerabilidad

12/06/2026

[CVE-2026-45170] Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and con…

Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11933] A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when convert…

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who is able to run server-side JavaScript (for example, via $where or $function) can cause the server to access memory that has already been freed. This may result in disclosure of information from the mongod process…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53813] OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading wh…

OpenClaw before 2026.4.25 contains a path traversal vulnerability in memory-core artifact loading where workspace state influences local package root resolution. Attackers with access to affected workspaces can load memory-core artifacts from unintended local locations, potentially executing malicious code or accessing sensitive data.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48547] KanaDojo contains a command injection vulnerability that allows an attacker with pull request access…

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the Git…

nvdaltovulnerabilidad CVSS 7.3 NVD