Alertas de Seguridad de la Información

N Alto vulnerabilidad

19/06/2026

[CVE-2026-48139] There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that…

There is a NULL pointer dereference vulnerability in NI grpc-device in the data moniker service that may allow an attacker to cause a denial of service by triggering a crash.  Successful exploitation requires an attacker to provide an unknown value to the data moniker service. This affects NI grpc-device 2.17.0 and prior versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

19/06/2026

[CVE-2026-39998] Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certai…

Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity headers. This issue affects Apache APISIX: from 2.12.0 through 3.16.0. Users are recommended to upgrade to version 3.17.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

19/06/2026

[CVE-2026-53915] In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configu…

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-34192] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause a…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-41156] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause m…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a write use after free scenario. A shared resource (memory page) managed by a CPU thread of control (driver) and accessed by a GPU thread of control (Firmware) can cause a write UAF when the CPU thread frees the resource before the GPU FW has finished accessing …

nvdaltovulnerabilidad CVSS 7.7 NVD

E Alto vulnerabilidad

19/06/2026

[CVE-2026-11576] The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to ope…

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

19/06/2026

[CVE-2026-46461] Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerabi…

Dell Server Hardware Manager, versions prior to 3.2.2, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2025-7737] DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects …

DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-07-01-80/00-07, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-82-80/00-06, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-63-80/00-04, CHB(iSCSI)…

nvdaltovulnerabilidad CVSS 8.6 NVD

P Alto vulnerabilidad

19/06/2026

[CVE-2026-12044] SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<descripti…

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS ''`` for a user-supplied description field. The Jinja templates for Domains (and their constraints), Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description directly inside a single-quoted SQL literal -- ``'{{ data.description }}'`` -- instead o…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56075] PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI mo…

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56076] PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint …

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests a…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-56078] PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to …

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

18/06/2026

[CVE-2026-54017] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the terminal-server reverse proxy in `backend/open_webui/routers/terminals.py` does not fully confine the user-controlled `path` segment before forwarding it to an admin-configured terminal server. An authenticated user who has been granted access to a terminal server can craft `path`…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-47633] Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experience…

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-32174] Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges ove…

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-46699] conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted…

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository inv…

nvdaltovulnerabilidad CVSS 7.6 NVD

C Alto vulnerabilidad

18/06/2026

[CVE-2026-43994] Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contai…

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer overflow in decode_oauth_token_gcm(). A uint16_t nonce_len field read from an attacker-supplied OAuth access token (0-65535) is passed directly to memcpy() as the copy length into a 256-byte stack buffer (oauth_encrypted_block.nonce[256]) without bounds checking. The overflow occurs…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-48716] nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge…

nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts constructs a filesystem path using the fileName field from an incoming WhatsApp document message without sanitization. The WhatsApp bridge downloads media attachments and writes them to disk using a filename derived from the sender's message via documentMessage.fileName, which is co…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-25865] Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows …

Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll Control_RunDLL input.dll. Attackers can place a malicious executable earlier in the search order to achieve arbitrary code execution in …

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

18/06/2026

[CVE-2026-12390] In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by a…

In AzeoTech DAQFactory versions 21.1 and prior, a Type Confusion vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD