Alertas de Seguridad de la Información

A Alto vulnerabilidad

09/07/2026

[CVE-2026-57111] Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.s…

Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests to administrative REST endpoints via a cross-origin request from an arbitrary origin, since th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15000] The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scr…

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag…

nvdaltovulnerabilidad CVSS 7.2 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-31984] A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audi…

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.

nvdaltovulnerabilidad CVSS 7.5 NVD

C Alto vulnerabilidad

09/07/2026

[CVE-2026-47829] Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH option…

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation. Affected versions: bosh-cli versions prior to v7.10.4.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-47830] Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder a…

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

09/07/2026

[CVE-2026-41857] A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's work…

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh (or bosh scp/bosh logs -f) with default flags. Affected versions: BOSH CLI versions prior to 7.10.5.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15135] A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an u…

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argument update results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15137] A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability …

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15134] A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by t…

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/index.php. Executing a manipulation of the argument email can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54783] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF WS-Security endorsing and supporting signature verification does not ensure the selected ds:Signature covers the expected Security header target, allowing an attacker with one captured signed SOAP envelope to replay arbitrary service operations as the victim principal. Th…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54784] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In ver…

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation can expose the proof key recovered from the RSTR when TransportWithMessageCredential with Windows client credentials and session establishment are used, allowing an observer to impersonate the authenticated Windows principal and decrypt or …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-59723] Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the…

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCo…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54774] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, SamlSerializer skips final SignatureValue verification when a CoreWCF service validates SAML tokens using a non-X.509 signing token, allowing an attacker to reference a non-X.509 SecurityToken key identifier and bypass assertion signature verification. This issue is fixed in vers…

nvdaltovulnerabilidad CVSS 7.4 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15129] Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potent…

Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15132] Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15133] Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker …

Use after free in InterestGroups in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54772] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, an unauthenticated remote attacker that can reach a NetTcpBinding, NetNamedPipeBinding, or UnixDomainSocketBinding endpoint can trigger premature EOF handling in the CoreWCF net.tcp, net.pipe, or net.uds framing handshake and pin one server thread-pool worker at full CPU per conn…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15119] Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had comp…

Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15120] Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker…

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15121] Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execu…

Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD