Alertas de Seguridad de la Información

N Alto vulnerabilidad

22/06/2026

[CVE-2026-54293] NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials s…

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() deco…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54275] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have bee…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54277] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54278] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, dur…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54279] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, hos…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54280] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, pay…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54273] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54274] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if …

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

22/06/2026

[CVE-2026-53539] Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing applicati…

Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every fi…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50269] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12530] Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent…

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to version 1.6.1.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-26240] In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code wit…

In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltration of local files.

nvdaltovulnerabilidad CVSS 8.4 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53842] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-42851] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write b…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval …

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45833] A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a…

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45830] A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows …

A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45831] The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaD…

The SimpleRBACAuthorizationProvider authorization provider in versions 0.5.0 or later of the ChromaDB Python project evaluates whether a user holds a given permission but never checks which tenant, database, or collection that permission applies to allowing users to perform cross tenant actions.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45832] All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database…

All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints.

nvdaltovulnerabilidad CVSS 8.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52858] Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi…

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is …

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52860] Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-comple…

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-con…

nvdaltovulnerabilidad CVSS 7.8 NVD