Alertas de Seguridad de la Información

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-3490] picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire…

picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass the entire blocklist by resolving any dangerous function through indirect REDUCE calls. Remote attackers can invoke any blocked function such as os.system, builtins.exec, or subprocess.call to achieve remote code execution.

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

17/06/2026

[CVE-2026-47103] Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that …

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enablin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

17/06/2026

[CVE-2026-49268] A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction i…

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonati…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54194] Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Contributor PHP Object Injection in Fusion Builder

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

17/06/2026

[CVE-2026-50203] A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`…

A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)`) let a malicious or compromised remote SFTP server write files outside the configured local destination directory via crafted directory-entry names. No Airflow account is required — the attack surface is any deployment downloading directories from an untrusted SFTP server. Upgrade `apache-airflow-p…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46963] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46964] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46949] Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (componen…

Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. Successful attacks of this vulnerability can result in unauthorized cre…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46944] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46945] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46946] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46933] Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Inte…

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly im…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46930] Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Bu…

Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.12-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle In-Memory Cost Management for Discrete Industries. Successful attacks of this…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46918] Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business S…

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. While the vulnerability is in Oracle Process …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46895] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46896] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework,…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46897] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46899] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, …

nvdcriticovulnerabilidad CVSS 9.6 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46900] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework,…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46901] Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (…

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. While the vulnerability is in Oracle Enterprise Command Center Framework, …

nvdcriticovulnerabilidad CVSS 9.9 NVD