Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20089] Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to exec…

Iperius Remote 1.7.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation path. When installed from directories containing spaces, attackers can place malicious executables in the path to be executed with elevated privileges during service startup or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20090] Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in th…

Comodo Dragon Browser versions up to 52.15.25.663 contain a privilege escalation vulnerability in the DragonUpdater service due to an unquoted service path running with SYSTEM privileges. A local attacker can insert a malicious executable in the service path and execute arbitrary code with elevated privileges upon service restart or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20091] Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local a…

Windows Firewall Control 4.8.6.0 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by inserting malicious executables in the service path. Attackers can place executable files in unquoted path directories that the wfcs.exe service will execute with LocalSystem privileges upon service restart or system reboot.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2016-20085] Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that…

Realtek High Definition Audio Driver 6.0.1.6730 contains an unquoted service path vulnerability that allows local attackers to escalate privileges by placing a malicious executable in the service path. Attackers can insert an executable file in the unquoted path and restart the service to execute code with LocalSystem privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-48895] URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker co…

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache APISIX. The attacker could manipulate some client headers to perform an open-redirect, to potentially expose the session token. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-49872] Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route…

Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credentials from a different source. This issue affects Apache APISIX: from 3.0.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-47339] Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor…

Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themselves with credentials from a different source. This issue affects Apache APISIX: from 2.14.1 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48138] There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bo…

There is an out-of-bounds read vulnerability in the NI grpc-device streaming API due to a missing bounds check that may result in a denial of service. Successful exploitation requires an attacker to supply a specially crafted write request. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48139] There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that…

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash.  Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-39998] Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certai…

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

19/06/2026

[CVE-2026-53915] In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configu…

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-34192] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause a…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-41156] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause m…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing …

nvdaltovulnerabilidad CVSS 7.7 NVD

E Alto vulnerabilidad

19/06/2026

[CVE-2026-11576] The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to ope…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

19/06/2026

[CVE-2026-46461] Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerabi…

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2025-7737] DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects …

DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-07-01-80/00-07, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-82-80/00-06, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-63-80/00-04, CHB(iSCSI)…

nvdaltovulnerabilidad CVSS 8.6 NVD

P Alto vulnerabilidad

19/06/2026

[CVE-2026-12044] SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<descripti…

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description directly inside a single-quoted SQL literal -- ``'{{ data.description }}'`` -- instead o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56075] PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI mo…

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56076] PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint …

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56078] PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to …

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD