Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/06/2026

[CVE-2026-9860] The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code …

The Offload, AI & Optimize with Cloudflare Images plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.10.2 via the 'account-id' parameter parameter. This is due to insufficient privilege enforcement on the cf_images_do_setup AJAX handler, which requires only the upload_files capability (Author+) rather than manage_options before writing to wp-config.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-55740] Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad)…

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=$busid) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context. A remote…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-12505] A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its r…

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted request_key payload to trick the root-owned helper into entering a custom environment (namespace) containing a malicious NSS module. This force…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-12407] The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorizatio…

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely — while reading an attacker-controll…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

18/06/2026

[CVE-2026-20253] Vulnerabilidad explotada activamente en Splunk Enterprise

CISA confirma explotación activa de una vulnerabilidad en Splunk Enterprise. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-21.

splunkexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

17/06/2026

[CVE-2026-45617] LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version…

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53676] ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution …

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50196] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propag…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50200] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default li…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48997] e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection v…

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six charact…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12530] Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent…

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to version 1.6.1.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-55202] Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during…

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circu…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

17/06/2026

[CVE-2026-55200] libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh…

libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54387] Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and…

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54388] Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Cont…

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Alto vulnerabilidad

17/06/2026

[CVE-2026-50107] When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an in…

When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the NginxProxy Custom Resource Definition (CRD) access log format setting are rendered directly into NGINX configuration templates without sanitization or escaping. A…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-11407] Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated adm…

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perfo…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12529] A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Pr…

A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

17/06/2026

[CVE-2026-10696] Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026…

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-55196] Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration…

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers…

nvdcriticovulnerabilidad CVSS 9.1 NVD