Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71314] Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an …

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-20313] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20313 are related to Improper link resolution before file access…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70378] imagecli's `carve <ratio>` pipeline operation (Carve::apply() in src/image_ops.rs) only asserts `rat…

imagecli's `carve ` pipeline operation (Carve::apply() in src/image_ops.rs) only asserts `ratio

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-40272] Improper Input Validation in the decode() function of the traceparser library could allow an attacke…

Improper Input Validation in the decode() function of the traceparser library could allow an attacker with a corrupted kernel trace event log (.kev) file, to execute arbitrary code or cause a crash in processes that use libtraceparser in QNX hosts or targets.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59531] Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.

Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59532] Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions.

Unauthenticated Other Vulnerability Type in Booking and Rental Manager

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-58662] Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrif…

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/07/2026

[CVE-2026-66374] Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ …

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-11721] It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number …

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set `synth-from-dnssec yes;` (whic…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-32665] In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enab…

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC connection (stream_id 0 and 4) bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte length prefix has been received from the initial streams. As a result, a remote client can make Un…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47667] CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the…

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an Analyze/NIfTI file and passed directly to `new unsigned char[header_size]` without being bounded against the actual file size. A value up to ~4 GB is accepted. If the subsequent `fread` returns `short` as it will for any m…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

09/07/2026

[CVE-2026-57023] An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Junip…

An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS). When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP h…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

08/07/2026

[CVE-2026-59879] Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set,…

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abor…

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

06/07/2026

[CVE-2026-54234] vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into t…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

02/07/2026

[CVE-2026-55952] The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried …

The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:us…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57623] Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

Unauthenticated Arbitrary Code Execution in W3 Total Cache

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56035] Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.

Unauthenticated Multiple Vulnerabilities in BitFire Security

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49110] Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.

Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49078] Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

Unauthenticated Other Vulnerability Type in WP Travel Engine

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-45441] Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.

Unauthenticated Other Vulnerability Type in WpEvently

nvdaltovulnerabilidad CVSS 7.5 NVD