Alertas de Seguridad de la Información

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43724] The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPad…

The issue was addressed with improved input sanitization. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43725] The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26…

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43701] The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and i…

The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43705] A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS…

A type confusion issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57999] luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RP…

luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing shell substitutions like $() to be evaluated by the out…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-58000] luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerabili…

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the pope…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57950] ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerabilit…

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read ope…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57955] SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to…

SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated into ClickHouse queries to read all stored traces, logs, and metrics, or abuse the url() function to per…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57947] Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registrat…

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-56285] Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and use…

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-56780] Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/a…

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13592] A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. A…

A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach fo…

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

29/06/2026

[CVE-2026-36848] Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-12912] A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a speci…

A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (D…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-13744] Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allow…

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to pr…

nvdaltovulnerabilidad CVSS 8.3 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-13749] Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI vers…

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the us…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

29/06/2026

[CVE-2026-41052] Improper privilege handling could be used by users with Project Owner role to escalate privileges, i…

Improper privilege handling could be used by users with Project Owner role to escalate privileges, in Rancher versions 2.14 before 2.14.2, 2.13 before 2.13.6, and 2.12 before 2.12.10.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13580] A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the function form…

A security vulnerability has been detected in Edimax EW-7478APC 1.04. This affects the function formQoS of the file /goform/formQoS of the component POST Request Handler. The manipulation of the argument selSSID leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but d…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13582] A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of t…

A flaw has been found in Edimax EW-7478APC 1.04. This issue affects the function formUSBAccount of the file /goform/formUSBAccount of the component POST Request Handler. This manipulation of the argument UserName/Password causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure bu…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13583] A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of …

A vulnerability has been found in Edimax EW-7478APC 1.04. Impacted is the function formUSBFolder of the file /goform/formUSBFolder of the component POST Request Handler. Such manipulation of the argument ShareName/SelectName leads to buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disc…

nvdaltovulnerabilidad CVSS 8.8 NVD