Alertas de Seguridad de la Información

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47967] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

14/07/2026

[CVE-2026-47968] Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code exe…

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45756] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match() and search() filter patterns directly into preg_match() without a length cap, i-regexp restriction, or bounded backtracking, allowing catastrophic-backtracking expressions to pin worker CPU and cause …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47290] Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15747] Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CS…

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59886] pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its manti…

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-59891] sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, ge…

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for an…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58640] Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59197] Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a n…

Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in versi…

nvdaltovulnerabilidad CVSS 8.2 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59200] Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/Pdf…

Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59884] pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and …

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error form…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

14/07/2026

[CVE-2026-59885] pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process…

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58609] Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code l…

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58610] Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to …

Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58618] Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code…

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58631] Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally…

Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58608] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56170] Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker…

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55012] Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code…

Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55899] Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute cod…

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD