Alertas de Seguridad de la Información

L Crítico vulnerabilidad

22/06/2026

[CVE-2026-10561] IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python exe…

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-56382] Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code exec…

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and

nvdaltovulnerabilidad CVSS 7.2 NVD

P Crítico vulnerabilidad

20/06/2026

[CVE-2026-5366] Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-contr…

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as `--upload-pack`, enabling execu…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2024-58351] Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the…

Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and the backend Prediction API. Because this feature is enabled by default with no allow-list of permitted variables and relies on vm2 for sandboxing, an attacker can abuse it to achieve remote code execution and sandbox escape, …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2022-50972] WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute ar…

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-36418] JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling…

JimuReport versions 2.3.4 and below are vulnerable to remote code execution due to improper handling of Aviator expressions. The /jmreport/executeSelectApi endpoint passes user-supplied input directly to the Aviator expression engine without adequate validation allowing attackers to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

17/06/2026

[CVE-2026-47103] Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that …

Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary code by supplying malicious SCXML documents containing crafted `` attributes evaluated unsafely. The SCXMLProcessor passes attacker-controlled expression strings through a call chain ending in Python's built-in eval() without sandboxing, enablin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54816] Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads…

Improper Control of Generation of Code ('Code Injection') vulnerability in Monetizemore Advanced Ads allows Remote Code Inclusion. This issue affects Advanced Ads: from n/a through 2.0.21.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-49113] Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

Subscriber Arbitrary Code Execution in Cornerstone < 7.8.8 versions.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-40783] Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions.

Contributor Remote Code Execution (RCE) in Blocksy Companion Pro

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-25470] Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom …

Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin for WordPress allows Remote Code Inclusion. This issue affects ACPT (Pro) - Custom Post Types Plugin for WordPress: from n/a through 2.0.47.

nvdcriticovulnerabilidad CVSS 10.0 NVD

O Crítico vulnerabilidad

17/06/2026

[CVE-2026-46850] Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The suppo…

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attack…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46851] Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (compone…

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Campus Community. Successful attacks of this vulnerability can result in takeover of PeopleSoft E…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24155] NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploi…

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-48836] Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Unauthenticated Remote Code Execution (RCE) in Easy Invoice

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-39465] Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50880] An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to e…

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50871] An OS command injection vulnerability in the media archiving and export pipeline component of kanish…

An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD