Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50872] An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attacker…

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

R Crítico vulnerabilidad

15/06/2026

[CVE-2026-30120] remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability…

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-52704] Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P…

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

nvdcriticovulnerabilidad CVSS 10.0 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54057] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

nvdaltovulnerabilidad CVSS 7.8 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-42851] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write b…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue body in a TUI, etc. — can cause kitty to execute attacker-supplied Python inside the running kitty process, with the user's full privileges. There is no approval …

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

12/06/2026

[CVE-2026-45833] A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an a…

A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Crítico vulnerabilidad

12/06/2026

[CVE-2026-54133] jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem…

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into gener…

nvdcriticovulnerabilidad CVSS 9.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52858] Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi…

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is …

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-52860] Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-comple…

Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. Python evaluates function default values, parameter annotations, and class base expressions at definition time, so a hostile buffer can execute attacker-con…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

11/06/2026

[CVE-2026-47162] Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injecti…

Vim is an open source, command line text editor. Prior to version 9.2.0495, a Vimscript code injection vulnerability exists in s:NetrwBookHistSave() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when serializing browsed directory paths to the history file ~/.vim/.netrwhist. A directory name derived from the filesystem is interpolated into a single-quoted Vimscript string lit…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-44495] Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. …

nvdaltovulnerabilidad CVSS 7.0 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2026-50223] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low…

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46432] LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-46517] LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.1…

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47292] Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorize…

Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45583] Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an una…

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2017-20251] WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that al…

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the ser…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-8795] A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velocir…

A YAML injection vulnerability exists in the Windows.Collectors.Remapping artifact of Rapid7 Velociraptor before version 0.76.6. The hostname field in client_info.json inside a collection ZIP is inserted into a YAML template via Go's text/template without escaping. An attacker providing a crafted collection ZIP can leverage literal double quotes and newlines in the hostname to break out of the YAM…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11688] Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attack…

Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD