Alertas de Seguridad de la Información

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54387] Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and…

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54388] Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Cont…

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-53805] NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vuln…

NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code execution vulnerability in the inference API server where the /request-inference and /seed-model endpoints deserialize raw HTTP request bodies using Python's pickle.loads() without authentication or input validation. Attackers can supply a crafted payload containing a __reduce__ gadget to the inference API port t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

17/06/2026

[CVE-2026-20266] In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute ar…

In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation.

nvdcriticovulnerabilidad CVSS 9.1 NVD

C Crítico vulnerabilidad

17/06/2026

[CVE-2026-20181] A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute ar…

A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-71325] picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling …

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the correct range and allowing malicious pickle files to bypass detection. Attackers can craft pickle files with arguments at position zero to trigger unexpected exceptions and evade security scanning.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2025-71321] picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to b…

picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util.write_file. Attackers can construct malicious pickle objects to overwrite critical system files and achieve denial of service or remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

17/06/2026

[CVE-2026-47103] Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that …

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enablin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

17/06/2026

[CVE-2026-49268] A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction i…

A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate the DN structure used for LDAP bind authentication, potentially bypassing authentication or impersonati…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-48055] Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versi…

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction, allowing a malicious archive to perform path traversal and write arbitrary files to the host filesystem. …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-40783] Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-39596] Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-27429] Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Nifty

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46978] Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daem…

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Suc…

nvdcriticovulnerabilidad CVSS 10.0 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46963] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46964] Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work…

Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Universal Work Queue. While the vulnerability is in Oracle Universal Work Queue, attacks …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46944] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46945] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46946] Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operati…

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope cha…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46933] Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Inte…

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. While the vulnerability is in Oracle Applications Manager, attacks may significantly im…

nvdcriticovulnerabilidad CVSS 9.9 NVD