Alertas de Seguridad de la Información

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50628] A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres…

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-48611] Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth i…

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47367] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47369] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47370] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47365] Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows …

Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

12/06/2026

[CVE-2026-35273] Vulnerabilidad explotada activamente en Oracle PeopleSoft Enterprise PeopleTools

CISA confirma explotación activa de una vulnerabilidad en Oracle PeopleSoft Enterprise PeopleTools. Esta vulnerabilidad ha sido utilizada en campañas de ransomware activas. Fecha límite para aplicar parche según directiva CISA: 2026-06-15.

oracleexplotación activavulnerabilidad Ransomware CISA KEV

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42846] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's …

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, ClipBucket's Remote Play feature allows any authenticated user to add a video by importing an external URL as the source. Some shell commands are run with the URL as a parameter. The URL is concatenated directly into shell commands without escaping then executed, so any shell metacharacter in the URL is interpre…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-45060] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/p…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthenticated user can exploit the ids parameter to execute SQL queries and exfiltrate sensitive data. This issue has been patched in version 5.5.3 - #129.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-49060] Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege E…

Incorrect Privilege Assignment vulnerability in Hippoo Mobile App for WooCommerce allows Privilege Escalation. This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.9.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-39494] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue affects Product Filter by WBW: from n/a through 3.1.2.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-42647] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport: from n/a through 5.7.7.

nvdcriticovulnerabilidad CVSS 9.3 NVD

G Crítico vulnerabilidad

11/06/2026

[CVE-2026-12027] Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a…

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-41005] Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a …

Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (ACS) when wantAssertionSigned is set to false. Assertions or responses that were unsigned but contained encrypted content could still be accep…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-49973] Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows u…

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an a…

nvdcriticovulnerabilidad CVSS 9.4 NVD

P Crítico vulnerabilidad

11/06/2026

[CVE-2026-45177] Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its int…

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request. Under specific circumstances, this could allow the attacker to manipulate internal validation mechanisms, potentially leading to a bypass of identity verification and the…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-49261] MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11…

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-9648] The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS cli…

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-11839] Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies …

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.002 before V2026.06.003.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-38581] SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attacker…

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) and the id parameter (line 49). The parameters are concatenated directly into SQL queries without sanitization or parameterized statements.

nvdcriticovulnerabilidad CVSS 9.8 NVD