Alertas de Seguridad de la Información

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-53405] Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with a…

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy script is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-44180] Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like…

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. Versions 2.0.0rc1 and above prior to 3.3.0 have a prohibited UID and GID feature that by default prevents launching kernels with UID or GID 0 (root), and this restriction can be bypassed using a specially crafted KERNEL_UID or KERNEL_GID value. This input…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-62390] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-62392] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-58319] Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication.…

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. U…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-59083] Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allo…

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recom…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-59084] Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to secure…

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support …

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

13/07/2026

[CVE-2026-41041] URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This …

URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This issue affects Apache Gravitino: from 1.0.0 before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-40005] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-40008] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in …

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-28564] Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoT…

Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-41042] Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which exe…

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

07/07/2026

[CVE-2026-33264] A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro…

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Us…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-56140] Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns comp…

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being writt…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-53913] Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failin…

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is no…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48203] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), …

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48205] Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS comp…

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers whose constant values (DnsConstants.DNS_SERVER, DNS_NAME, DNS_DOMAIN, DNS_TYPE, DNS_CLASS, TERM) were t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-43867] Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc compon…

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component. The camel-pqc component persists post-quantum key metadata (KeyMetadata) through pluggable KeyLifecycleManager implementations. AwsSecretsManagerKeyLifecycleManager.deserializeMetadata() reads that metadata back from the configured AWS Secrets Manager secret by Base64-decoding the stored value and deserializing it with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46454] Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen…

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - in…

nvdcriticovulnerabilidad CVSS 9.8 NVD