Alertas de Seguridad de la Información

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48334] Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary…

Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.3 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-48284] ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary …

ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-13001] The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to mi…

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlove_handle_cache_files' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-51599] An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build …

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-41042] Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which exe…

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48316] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-56140] Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns comp…

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being writt…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48203] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), …

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48204] Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gr…

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the default. The control-header constants (GridFsConstants.GRIDFS_OPERATION, GRIDFS_OBJECT_ID, GRIDFS_MET…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48205] Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS comp…

Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or domain to look up, the record type and class, and the search term - from Exchange message headers whose constant values (DnsConstants.DNS_SERVER, DNS_NAME, DNS_DOMAIN, DNS_TYPE, DNS_CLASS, TERM) were t…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46454] Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd componen…

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux (CometD) message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplied by the CometD client directly onto the Camel message (message.setHeaders), so any header name - in…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-46456] Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs com…

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers being written to the broker) but did not…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-22547] Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including l…

Gitea versions before 1.25.5 lack validation constraints for repository creation fields, including length-limited template fields and trust model or object format values.

nvdcriticovulnerabilidad CVSS 9.1 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-54402] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-50748] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14411] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14382] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Crítico vulnerabilidad

01/07/2026

[CVE-2026-53492] containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI…

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying sol…

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14120] Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at…

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14104] Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47…

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.8 NVD