Alertas de Seguridad de la Información

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46912] Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Run…

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significa…

nvdcriticovulnerabilidad CVSS 9.3 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46910] Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterpr…

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50870] An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1…

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-39007] An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitiv…

An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

12/06/2026

[CVE-2026-44786] Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2…

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44486] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale P…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

10/06/2026

[CVE-2026-45329] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, …

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c validated only some of the caller-supplied pointer arguments, leaving input pointer arguments unchecked. Because the underlying TEE-protected hardware peripherals (e.g., ECC, SHA, SPI) run in RISC-V machi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36719] An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows…

An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated attackers to obtain sensitive information, including SHA256 password hashes, via enumerating user IDs.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-0411] An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could al…

An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected to your network to gain administrator access to the Orbi router. The listed NETGEAR models are affected by this vulnerability. Orbi WiFi Systems without satellite devices are not impacted by this issue.

nvdaltovulnerabilidad CVSS 8.0 NVD

A Alto vulnerabilidad

05/06/2026

[CVE-2026-45300] The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and async…

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Versions on the 2.x branch prior to 2.15.0 and the 3.x branch prior to 3.0.10 leak `Cookie` headers to cross-origin redirect targets. When following a redirect to a different origin, the `propagatedHeaders()` method in `Redirect30xInterceptor.java` strips `Authoriza…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-69755] An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensit…

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted command to the at_command.asp interface

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-50210] The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making …

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to replay attacks and known-plaintext decryption.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49193] Overly permissive configuration settings on cloud storage containers expose active telemetry informa…

Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the internet.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49187] The hard-coded APK resource files never expire, and the shared scepter leads to information leaks an…

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-36611] Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w…

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-41032] It is possible for an unauthenticated adjacent attacker to download log files of the controller, whi…

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some restricted information.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

02/06/2026

[CVE-2026-32625] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-co…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-45553] NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reSt…

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable…

nvdaltovulnerabilidad CVSS 7.5 NVD