Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13760] OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cd…

OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-57723] Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al…

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-57736] Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded …

Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

nvdaltovulnerabilidad CVSS 7.4 NVD

E Alto vulnerabilidad

01/07/2026

[CVE-2026-49091] Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Inject…

Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that is written to log files without proper neutralization. When the log files are subsequently viewed in a terminal that interprets control sequences, the injected content may alter the displayed log data.

nvdaltovulnerabilidad CVSS 8.0 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54428] Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpCompo…

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

01/07/2026

[CVE-2026-46680] containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1,…

containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58452] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft a string beginning with a valid MAC-like prefix followed by a semicolon and a shell payload, which bypas…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58454] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the c…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-57516] Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that a…

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=Fal…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54399] Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpCompone…

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20217] A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote at…

A vulnerability in the PESpin file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PESpin files during scanning, which may result in an out-of-bounds buffer write. An attacker could expl…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20243] A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the ALZ file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in ALZ files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit th…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20244] A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the DMG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in DMG files during scanning, which may result in an integer overflow on 32-bit platforms only. An attacker c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-20191] A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arb…

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container.  This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read arbitrary files …

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20213] A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attack…

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20214] A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit th…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20215] A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attack…

A vulnerability in the 7z file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in 7z files during scanning, which may result in an out-of-bounds buffer write. An attacker could exploit this…

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

01/07/2026

[CVE-2026-20216] A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, re…

A vulnerability in the InstallShield file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper handling of temporary resources during file scanning. An attacker could exploit this vulnerability by submitting a crafted InstallShield file to be scanned by ClamAV on an affected device. A succes…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-8857] A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program fi…

A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timeline: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58036] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

nvdaltovulnerabilidad CVSS 7.5 NVD