Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47368] A malicious actor with access to the network could exploit a Path Traversal vulnerability found in c…

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 8.6 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses…

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-49982] tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a…

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.proto…

nvdaltovulnerabilidad CVSS 8.2 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-44705] tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package conta…

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the config…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-53777] Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server t…

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, ca…

nvdaltovulnerabilidad CVSS 8.1 NVD

K Alto vulnerabilidad

11/06/2026

[CVE-2026-11816] Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction ut…

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40987] A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client file…

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-52726] Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Starting in version 0.23.2 and prior to version 1.2.5, `dulwich.porcelain.submodule_update`, and by extension `porcelain.clone(..., recurse_submodules=True)`, materializes attacker-controlled submodule paths from a crafted upstream repository without path validation. A malicious `.gitmodules` plus a matching tree gitlin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-46703] Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and la…

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite allows users to specify the OCI image used by containers in the sandbox. However, when processing tar entries in OCI images, Boxlite does not account for the possibility that entries may be symlinks pointing to ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42305] Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting wit…

Dulwich is a pure-Python implementation of the Git file formats and protocols. Versions starting with 0.10.0 and prior to 1.2.5 have an arbitrary file write leading to remote code execution when cloning or checking out a malicious Git repository on Windows. Dulwich's path-element validator accepted tree entries whose filenames contained bytes that Windows interprets as structural path syntax. Cont…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-0270] A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux …

A path traversal vulnerability in Palo Alto Networks Cortex XSOAR engine software running on Linux allows an unauthenticated attacker on an adjacent network, with the ability to intercept and manipulate network response traffic via a man-in-the-middle (MITM) attack, to write arbitrary files to the host.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50567] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/e…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45569] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ommit d4d10006 ("Expand validation to block .. in config_file_name and configver for improved security") added a line in app/modules/config/config.py:462. This is tuple-membership, not substring containment — '..' in (a, b, c) evaluates to True only if any of a, b, c is equal to th…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45565] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, EscapedString (app/modules/roxywi/class_models.py:16-30) is the centralised Pydantic validator used on dozens of fields including SSH credential name, username, description, etc. Its if/elif/elif/else flow returns the metacharacter-stripped value without also enforcing the .. block…

nvdaltovulnerabilidad CVSS 8.1 NVD

K Crítico vulnerabilidad

10/06/2026

[CVE-2026-53476] A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local…

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gzipped tarball, the attacker can bypass security checks and write arbitrary files to the system. This could ultimately lead to the execution of unauthorized code on the appliance.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…

nvdcriticovulnerabilidad CVSS 9.9 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52752] Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails t…

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52755] Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that …

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-44716] Pipecat is an open-source Python framework for building real-time voice and multimodal conversationa…

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in Pipecat's development runner (src/pipecat/runner/run.py). When the runner is started with the --folder flag, it exposes a GET /files/{filename:path} download endpoint. The filename path parameter is conca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46491] SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp mod…

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticket directory with an attacker-controlled ticket identifier. Public CAS validation/proxy endpoints pass attacker-controlled ticket / pgt query…

nvdaltovulnerabilidad CVSS 8.6 NVD