Alertas de Seguridad de la Información

G Crítico vulnerabilidad

16/06/2026

[CVE-2026-0126] In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead …

In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-53776] Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass…

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by exploiting the unconditional setting of validate_exp = false in the verify_decode helper within the stdlib JWT verification path. Attackers in possession of a previously issued bearer token can present expired tokens to any jwt.verify() call and retain authenticated access indef…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12315] Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firef…

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12316] Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Th…

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12304] Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Fire…

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12293] Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Th…

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12294] Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox E…

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12295] Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefo…

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12296] Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefo…

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12297] Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability …

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-40750] Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store al…

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Shell to a Web Server. This issue affects Kids Online Store: from n/a through 0.8.9.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-52715] Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Unauthenticated SQL Injection in GEO my WordPress

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-39574] Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Unauthenticated SQL Injection in InPost Gallery

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49772] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12205] Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key …

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected versio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

15/06/2026

[CVE-2026-48713] Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when u…

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in l…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

15/06/2026

[CVE-2026-48714] i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti…

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-k…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12087] Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_s…

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-11832] Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The defa…

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

nvdcriticovulnerabilidad CVSS 9.1 NVD