Alertas de Seguridad de la Información

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53840] OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP se…

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-50656] Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Micros…

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

16/06/2026

[CVE-2026-47964] DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability t…

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-47749] stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wa…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode ha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-39575] update_disk_psu_baseline.sh requires password in plain text

update_disk_psu_baseline.sh requires password in plain text

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-42089] Yeoman Environment provides an API to discover, create, and run generators, and to configure where a…

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package install…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-44932] Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 co…

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24155] NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploi…

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24228] NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization…

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2025-71261] An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE H…

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-10649] A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vu…

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-24909] Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vul…

Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated user could potentially exploit this vulnerability to escalate privileges. The malicious user may gain the ability to run arbitrary code remotely. This is a high severity vulnerability so Dell recommends customers to upgrade at the earliest opp…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-47684] Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and synci…

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1), allowing SSRF protection to be bypassed on dual-stack systems. Version 2.3.0 fixes the issue.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-48780] Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously craft…

Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email ad…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12398] A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the lega…

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12324] Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed i…

Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12326] Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of…

Memory safety bugs present in Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12327] Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbir…

Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12328] Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefo…

Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbi…

nvdaltovulnerabilidad CVSS 8.1 NVD