Alertas de Seguridad de la Información

W Alto vulnerabilidad

25/06/2026

[CVE-2026-55967] AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were no…

AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55487] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stri…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55698] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap m…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager loc…

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-50015] pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/pat…

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff…

nvdaltovulnerabilidad CVSS 7.3 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-11999] X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (…

X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those users it is critical, otherwise the library is unaffected. Native wolfSSL TLS/DTLS usage is not impacted. X509_verify_ce…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-9099] A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint…

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such…

nvdaltovulnerabilidad CVSS 7.7 NVD

D Alto vulnerabilidad

25/06/2026

[CVE-2026-56123] socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allow…

socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55412] ToolJet is the open-source foundation am AI-native platform for building and deploying internal tool…

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the A…

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-54030] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreCha…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-45233] HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authentic…

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences directly to file_exists() and rename() functions in admin.php without canonicalization or directory bounda…

nvdaltovulnerabilidad CVSS 8.1 NVD

Z Alto vulnerabilidad

25/06/2026

[CVE-2026-13351] Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by…

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, …

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-9716] CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition…

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-9717] CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabili…

CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service.

nvdaltovulnerabilidad CVSS 7.2 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-9650] CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and …

CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

25/06/2026

[CVE-2026-57455] Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_…

Vim is an open source, command line text editor. Prior to 9.2.0698, the single-byte branch of spell_soundfold_sofo() in src/spell.c translates a word through a spell file's SOFO (sound-folding) byte map into a caller-owned result buffer. Its copy loop advances the output index ri with no upper bound and terminates only on the input NUL, writing one byte per input byte into the MAXWLEN-element stac…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

25/06/2026

[CVE-2026-57456] Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (ru…

Vim is an open source, command line text editor. Prior to 9.2.0699, Vim's Python omni-completion (runtime/autoload/python3complete.vim and the legacy pythoncomplete.vim) executes reconstructed function and class definitions from the current buffer with exec() as part of populating the completion dictionary. When reconstructing that source, each scope's docstring is inserted verbatim between triple…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

25/06/2026

[CVE-2026-55895] Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulne…

Vim is an open source, command line text editor. Prior to 9.2.0663, a Vimscript code injection vulnerability exists in s:NetrwLocalRmFile() in the netrw plugin (runtime/pack/dist/opt/netrw/autoload/netrw.vim) when deleting a local file from the browser. A filename derived from the buffer's directory listing is interpolated into an Ex command line passed to :execute with only the backslash characte…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55477] 3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated admini…

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). …

nvdaltovulnerabilidad CVSS 7.2 NVD

V Alto vulnerabilidad

25/06/2026

[CVE-2026-55693] Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function …

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12844] List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functi…

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc

nvdaltovulnerabilidad CVSS 7.5 NVD