Alertas de Seguridad de la Información

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47968] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45074] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can r…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58595] Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unautho…

Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54992] Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker …

Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-12523] Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (…

Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames. Impact HTTP/3 defines multiple frame types to support HTTP message exchanges and connection management. Each frame has a length and a payload whose length depends on the frame type. quiche was found to be vulnerable when parsing some …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-12707] Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to un…

Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. Impact quiche supports the connection migration features described in Section 9 of RFC 9000, which allows a single QUIC connection to survive changes in the network path. Although quiche implements the protections described in Section …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15392] DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust…

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers c…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10669] On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xte…

On Xtensa SoCs built with CONFIG_XTENSA_MPU and CONFIG_USERSPACE, arch_buffer_validate() in arch/xtensa/core/mpu.c — the architecture hook that verifies a user-mode-supplied buffer is accessible to the calling user thread with the requested permission — defaulted its return value to 0 (access permitted) and only set a denial result inside its per-MPU-region probe loop. When the rounded extent of t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10671] In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kerne…

In Zephyr's kernel pipe implementation, the userspace syscall verifier z_vrfy_k_pipe_init() in kernel/pipe.c used K_SYSCALL_OBJ() (which requires the kernel object to already be initialized) instead of K_SYSCALL_OBJ_NEVER_INIT() (which rejects an already-initialized object). As a result, on CONFIG_USERSPACE builds an unprivileged user thread that has been granted access to a k_pipe object can invo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15043] DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on tex…

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method,

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-59084] Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to secure…

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Other versions that have reached end of support …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58233] SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a…

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and ext…

nvdaltovulnerabilidad CVSS 7.6 NVD

F Crítico vulnerabilidad

14/07/2026

Out of bounds read in GUI

Fortinet PSIRT publica advisory de seguridad: Out of bounds read in GUI. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortiauthenticator.

firewall PAN PSIRT

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-58102] Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certi…

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes w…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62196] OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where What…

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62189] OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync featu…

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62191] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62192] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62186] OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible…

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62187] OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun…

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions

nvdaltovulnerabilidad CVSS 8.1 NVD