Alertas de Seguridad de la Información

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48276] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48277] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48281] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48283] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with …

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48286] Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-14241] Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corrupti…

Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8655] Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredict…

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver deployment

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Crítico vulnerabilidad

30/06/2026

[CVE-2026-8452] Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or errone…

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

H Crítico vulnerabilidad

30/06/2026

[CVE-2026-58116] LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers wit…

LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by supplying a malicious model path in the Chat or Training interfaces. The application passes user-supplied model path input unvalidated into AutoTokenizer.from_pretrained() and AutoModel.from_pretrained() with a hardcoded trust_remote_code=True param…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-13766] DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. …

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers (order_by, where-clause column keys, field and returning lists, upsert columns, and join aliases) reach the SQL string ra…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-14162] Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo…

Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-9711] The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to S…

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulnerable to SQL Injection via the WordPress 'search' parameter in versions up to, and including, 5.0.11 due to insufficient escaping on the user supplied parameter and lack of preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-55276] Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles…

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support …

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-53434] Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for…

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-37637] An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the fi…

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-39868] This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadO…

This issue was addressed with improved input validation. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or corrupt kernel memory.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-56782] Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restor…

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

29/06/2026

[CVE-2026-11720] A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When …

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the input does not alter the scheme, host, or user info, it relies on ResolveReference for the final URL …

nvdcriticovulnerabilidad CVSS 9.1 NVD

J Crítico vulnerabilidad

28/06/2026

[CVE-2026-49048] The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by …

The Joomla extension JoomCCK exposes a front-end controller task, that builds two SQL statements by directly concatenating a user-supplied request parameter into the query string without escaping or parameterisation.

nvdcriticovulnerabilidad CVSS 9.8 NVD