Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16398] Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thun…

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16400] Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 a…

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16405] Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Fire…

Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16391] Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox …

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-16387] Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firef…

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16373] Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed…

Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16374] Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firef…

Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16354] Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox …

Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-44231] RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6…

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credenti…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-51027] An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2…

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-52203] An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source par…

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49211] Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-53598] Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders…

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in version…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-45793] Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer…

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs__ format can contain -, fail validation, and be disclosed to stderr or …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-52101] An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensit…

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49853] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHT…

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-57102] Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize…

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50429] Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a …

Out-of-bounds read in Windows Kernel allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50697] Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver …

Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55651] Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposu…

Easy!Appointments is a self hosted appointment scheduler. In version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users. Using these hashes, an attacker can modify or delete appointments of other providers, resulting in an Appointments Takeover. Version 1.6.0 fixes the issue.

nvdaltovulnerabilidad CVSS 7.1 NVD