Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-10672] subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static…

subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no length validation. The Firmware-Update object stores the server-supplied Package URI (/5/0/1) in a 255-byte buffer, so a LwM…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15693] A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the fun…

A security vulnerability has been detected in Tenda BE12 Pro 16.03.66.23. This issue affects the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8314] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the sim…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the siman.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8085] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the mod…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the model.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8312] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the exp…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the expmt.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

14/07/2026

[CVE-2026-8313] A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the lin…

A security issue exists within Arena® Simulation due to a memory corruption vulnerability in the linker.exe (Siman) component. The vulnerability stems from improper validation of user-supplied data, which can result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process by convincing a user to open a malicious file.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-62390] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-62392] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi…

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version 5.0.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15692] A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the functio…

A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter of the file /goform/SafeUrlFilter. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15691] A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSaf…

A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the file /goform/SafeClientFilter. Performing a manipulation of the argument page results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54429] A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices d…

A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected applicatio…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-56451] A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do n…

A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an unauthenticated remote attacker to forge arbitrary JWT, bypass authentication mechanisms and impersonate any user including administrative accounts, potentially gaining full unauthorized access to t…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-3014] Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix s…

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-15043] DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on tex…

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method,

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-57898] In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments usin…

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter and passed it through repository file handling as both a repository key and, during thumbnail retri…

nvdcriticovulnerabilidad CVSS 9.0 NVD

A Crítico vulnerabilidad

14/07/2026

[CVE-2026-59083] Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allo…

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recom…

nvdcriticovulnerabilidad CVSS 9.1 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2026-15075] In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRe…

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Coo…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2026-15076] In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession com…

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15416] A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could all…

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticated attacker with network access to the Argo CD repo-server to achieve remote code execution. Under certain conditions, the attacker may then manipulate cached data to deploy malicious Kubernetes resources to managed clusters, potentially resulting in complete cluster compromise.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Medio vulnerabilidad

14/07/2026

CVE-2026-50678 Microsoft Excel Information Disclosure Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-50678 Microsoft Excel Information Disclosure Vulnerability. Tipo: Divulgación de Información.

info-disclosure Microsoft MSRC