Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46885] Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supporte…

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 8.8 (Confiden…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46873] Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device…

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significa…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46867] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in …

nvdaltovulnerabilidad CVSS 7.2 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46852] Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (c…

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Pla…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46804] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vu…

nvdaltovulnerabilidad CVSS 8.7 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46794] Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Gene…

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Identity Manager Connector. While the vulnerability is in Identity Manager Connector, attacks may sign…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35288] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: D…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerabi…

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35272] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: D…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12289] Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1…

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8176] The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab…

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-39118] An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privilege…

An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-36213] An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges v…

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12217] A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown f…

A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-46716] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to…

nvdcriticovulnerabilidad CVSS 9.9 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12018] Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l…

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45176] Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within…

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actio…

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-31272] The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may …

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50566] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor's high-privilege serv…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50570] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability c…

nvdaltovulnerabilidad CVSS 8.5 NVD