Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-56782] Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restor…

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-28701] Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated rem…

Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths.

nvdcriticovulnerabilidad CVSS 9.8 NVD

B Crítico vulnerabilidad

26/06/2026

[CVE-2026-54352] Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packag…

Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 accepts a builder-uploaded .zip, extracts it with extract-zip@2.0.1 into a temp directory, then for each entry listed in icons.json validates the icon path, opens it, and streams the bytes into MinIO. The resulting object is served back via GET /api/assets/{appI…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-52780] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This vulnerability is fixed in 17.3.3 and 17.4.1.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-46386] OpenProject is open-source, web-based project management software. Prior to , the official openproje…

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fix…

nvdcriticovulnerabilidad CVSS 9.9 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-54636] Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json f…

Dokku is a docker-powered PaaS. Prior to 0.38.7, the cron plugin utilizes commands in the app.json file to manage system cron running as the Dokku user. An app.json cron command utilizing special shell characters - including, but not limited to, > or ; - can break out of the Docker container and execute commands on the host as the Dokku user. This vulnerability is fixed in 0.38.7.

nvdcriticovulnerabilidad CVSS 9.0 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-45405] Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract…

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:from-archive and certs:add commands extract user-supplied tar/zip archives into temporary directories without sanitizing member paths or preventing symlink traversal. GNU tar creates symlinks during extraction and follows them for subsequent entries, allowing an attacker to write arbitrary files anywhere writable by the dokku user — includin…

nvdcriticovulnerabilidad CVSS 9.0 NVD

D Crítico vulnerabilidad

26/06/2026

[CVE-2026-45406] Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an ap…

Dokku is a docker-powered PaaS. Prior to 0.38.2, the openresty-vhosts plugin copies files from an app's openresty/http-includes/ git repository directory to the host and then interpolates their filenames, unescaped, into a single-quoted shell string that is later parsed by eval. A filename containing a single quote breaks the quoting and allows command substitution to execute arbitrary commands on…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2025-11919] The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` o…

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directorie…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57658] Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

Administrator Arbitrary File Upload in TemplateSpare

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57881] An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011…

An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploit this vulnerability by sending crafted login data with overly long input, resulting in memory corruption, denial of service, or potentially…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57879] An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 …

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when processing RTSP custom authentication data. A remote attacker may exploit this vulnerability by sending a crafted RTSP request, resulting in memory corruption, denial of service, or potentially arbitra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57880] An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 …

An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient bounds checking when parsing RTSP Digest authentication fields. A remote attacker may exploit this vulnerability by sending a crafted RTSP request containing overly long authentication data, resulting in memory corruption,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-40702] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate chargin…

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

nvdcriticovulnerabilidad CVSS 9.4 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71336] Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote co…

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentication and authorization model is minimal and lacks role-based access control, and the default installation runs without authentication unless…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71338] Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoin…

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71327] Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register …

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-56445] The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datase…

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

25/06/2026

[CVE-2026-54917] SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables.…

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, obj…

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

25/06/2026

[CVE-2026-50549] Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal comm…

Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails it falls back to the original path and writes without approval. A malicious agent can create an in-workspace symlink that points outside the…

nvdcriticovulnerabilidad CVSS 9.8 NVD