Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/07/2026

[CVE-2026-27414] Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.

Contributor PHP Object Injection in Werkstatt

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-27060] Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

Contributor PHP Object Injection in ARMember Premium

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-55153] mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c…

mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming.JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Suc…

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-14265] Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced …

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-51947] An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pi…

An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_20260316.zip) allows a remote attacker to execute arbitrary code via the Pivotal.Engine.Client.Services.Conversion.dll component. NOTE: this issue exists because of an incomplete fix for CVE-2026-39253.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-57516] Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that a…

Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=Fal…

nvdaltovulnerabilidad CVSS 8.8 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-58126] PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows…

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads …

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-58127] PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerE…

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the hos…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58025] Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerabil…

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24247] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24250] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper val…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper validation of allowed inputs. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24251] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper con…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of dynamically managed code resources. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24240] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24243] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24244] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24245] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserializat…

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-10538] Messaging consumer functionality allows deserialization of user-controlled data without sufficient r…

Messaging consumer functionality allows deserialization of user-controlled data without sufficient restriction of allowed object types in the out of support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier. This issue may allow an authenticated attacker to trigger unintended server-side behavior through crafted serialized content.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-56700] Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserial…

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, Install…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71349] picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle…

picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71350] picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run fu…

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD