Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-40454] Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bound…

Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server data. This issue affects Apache IoTDB C++ client: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15288] The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Impro…

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This m…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-51606] An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91)…

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-51599] An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build …

An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed …

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15122] Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871…

Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10037] A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME hand…

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, an…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

08/07/2026

[CVE-2026-59724] Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before …

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before 6.6.7, Engine.IO servers with WebTransport enabled can resolve a crafted session ID such as __proto__ through an inherited property of the clients object during WebTransport upgrade handling, causing a TypeError and denial of service. This issue is fixed in version 6.6.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-41042] Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which exe…

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing…

nvdcriticovulnerabilidad CVSS 9.1 NVD

V Alto vulnerabilidad

06/07/2026

[CVE-2026-54234] vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48316] ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnera…

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-49042] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46587] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46588] Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55994] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any HeaderFilterStrategy (IggyFetchRecords copied the message user-headers straight into the Exchange).…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-56140] Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns comp…

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter (setOutFilterPattern, which blocks Camel*, breadcrumbId and org.apache.camel.* headers from being writt…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-55993] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-atmosphere-websocket consumer mapped inbound WebSocket query parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (WebsocketConsumer.sendEventNotification() iterates t…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache …

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value was the plain string QUERY (and RETURN_LUCENE_DOCS for HEADER_RETURN_LUCENE_DOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderF…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46592] Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apa…

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operat…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46726] Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side R…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component. The camel-vertx-websocket consumer mapped inbound WebSocket query and path parameters into the Camel Exchange header map without applying any HeaderFilterStrategy (VertxWebsocketConsumer.populateExchangeHeaders()). Be…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-48203] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), …

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr component. The camel-solr producer copies Exchange message headers whose names begin with the SolrParam. prefix into the parameters of the Solr request, and headers whose names begin with the SolrField.…

nvdcriticovulnerabilidad CVSS 9.1 NVD