Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-55944] Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execu…

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50509] Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized…

Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45077] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist,…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55009] Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev…

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54117] Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a…

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54118] Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a…

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50652] Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny …

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-12583] The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input tha…

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58233] SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a…

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and ext…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-59521] Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr…

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59518] Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec…

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57770] Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all…

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57738] Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Inject…

Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Injection.This issue affects 777: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57744] Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a…

Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Object Injection.This issue affects RT-Theme 18 | Extensions: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57724] Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This …

Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57713] Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manage…

Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Object Injection.This issue affects Events Manager: from n/a through

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-57371] Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object In…

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-58281] Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker…

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-44795] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, …

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to 2026.1.0, 2026.0.3, 2025.4.4, and 2025.3.3, unsafe YAML processing bypasses safe deserialization when using CloudFormation deployments or CloudFoundry baking. The use of a non-safe constructor allows arbitrary loading of Java classes, leading to remote code execution. This issue is fixed in versions 2026.1.0, 2026.0.3,…

nvdaltovulnerabilidad CVSS 8.8 NVD