Alertas de Seguridad de la Información

J Crítico vulnerabilidad

12/06/2026

[CVE-2026-54133] jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem…

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into gener…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50632] A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lea…

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50633] A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can…

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50628] A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres…

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47367] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UID Enterprise Agent to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47369] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47370] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in certain devices running UniFi OS to execute a Command Injection within such UniFi OS devices or instances.

nvdcriticovulnerabilidad CVSS 9.9 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12034] Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior …

Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12016] Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote a…

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12009] Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7…

Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-49982] tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a…

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.proto…

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

10/06/2026

[CVE-2026-49218] ImageMagick is free and open-source software used for editing and manipulating digital images. Prior…

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-24, a missing check in the DCM decoder could result in an image with invalid dimensions and that could cause crashes in other operation. This issue has been patched in versions 6.9.13-48 and 7.1.2-24.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-48110] Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several r…

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could send oversized, high-fanout, or malformed length-prefixed fields and make the library allocate, attempt t…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46669] OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior t…

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theorem 3 of https://eprint.iacr.org/2024/640.pdf but does not check that the scaling factor s is in a proper subfield of Fp12. This allows incorrect results to the pairing check. This issue has been patche…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46679] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three co…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45783] libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauth…

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 16.2.6, an unauthenticated remote peer can exhaust the disk storage of any @libp2p/kad-dht node running in server mode by sending an unbounded stream of PUT_VALUE messages whose keys bypass all content validation. No credentials, no prior relationship, and no protocol deviation beyond a crafted key are required. The…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45062] FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the…

FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in that fallback let an attacker mislead FrankenPHP into treating a non-.php file as a .php script. In any deployment where the attacker can plac…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45565] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…

nvdcriticovulnerabilidad CVSS 9.9 NVD