Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47478] NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the us…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. A successful exploit of this vulnerability might lead to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45068] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45071] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15709] A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. …

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via max_incoming_payload_size, it fails to track or limit memory allocation during decompression. A sep…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15711] A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to …

A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or less. A remote, unauthenticated attacker can exploit this by sending a non-compliant, oversized control frame. Because the parser handles thi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47300] Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker t…

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47301] Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate …

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47302] Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny…

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47303] Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to ele…

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47304] Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a…

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47305] Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall…

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45304] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45305] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in version…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45073] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, PdoAdapter::doClear() builds a DELETE statement using a namespace derived from the caller-supplied $prefix without binding or escaping it, allowing a caller able to influence $prefix to break out of the LIKE literal and alter query semantics or deletion sco…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45075] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes can be configured for GET only, but Symfony routes HEAD requests to the GET handler while the attribute check is skipped, allowing protected controllers to execute and leak headers or perfor…

nvdaltovulnerabilidad CVSS 8.2 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45133] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted …

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

14/07/2026

[CVE-2026-15637] Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server…

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

14/07/2026

[CVE-2026-15641] Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1…

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15720] In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mob…

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58629] Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD