Alertas de Seguridad de la Información

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66279] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66280] An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating s…

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and …

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-62850] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520 an…

nvdaltovulnerabilidad CVSS 7.2 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-44716] Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa…

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is conca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46491] SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp mod…

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query…

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34711] CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer…

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34712] CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Imprope…

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-34713] CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontr…

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-48291] Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability…

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-48292] Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability…

Format Plugins versions 1.1.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47955] Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vuln…

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47959] Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Stack-based Buffer …

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47960] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML Exter…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malici…

nvdaltovulnerabilidad CVSS 7.4 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47931] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47932] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a mali…

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47937] Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Searc…

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file…

nvdaltovulnerabilidad CVSS 7.7 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47952] Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer O…

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47921] Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vuln…

Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47929] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerabi…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.4 NVD

A Alto vulnerabilidad

09/06/2026

[CVE-2026-47930] ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 8.1 NVD