Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/06/2026

[CVE-2026-9221] The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to g…

The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request signature for authenticating communications between the mobile client and the backend REST API. Attackers could potentially reverse the signature to recover the session ID. With the session ID exposed, an attacker could impersonate the legitimate user and issue authenticated API re…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-50176] The WebSocket Application Programming Interface lacks restrictions on the number of authentication r…

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-12975] A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParse…

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via ex…

nvdaltovulnerabilidad CVSS 8.5 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-12992] A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without di…

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forger…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12473] Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitra…

Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.

nvdaltovulnerabilidad CVSS 8.2 NVD

B Alto vulnerabilidad

25/06/2026

[CVE-2026-57520] Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authentic…

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in the bulk user-remove endpoint. Attackers can supply Admin organization-user IDs in a bulk DELETE request to bypass the guard enforced on the single-user removal…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56771] NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url e…

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal networks by failing to filter private IP addresses. Attackers can exploit this to access localhost services and cloud metadata endpoints, enabling internal network scanning and sensitive data exfiltration.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56769] Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request…

Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace users to make arbitrary server requests. Attackers can exploit this by supplying malicious URLs to fetch internal services, exfiltrate responses, and replay credentials against backend systems.

nvdaltovulnerabilidad CVSS 8.5 NVD

S Crítico vulnerabilidad

25/06/2026

[CVE-2026-54917] SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables.…

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, obj…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54096] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/` accepts an authenticated request for an arbitrary path and stores a public share record without checking whether the target file currently exists. Later, when a file is created at that same path, the previously created pu…

nvdaltovulnerabilidad CVSS 8.4 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-50015] pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/pat…

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff…

nvdaltovulnerabilidad CVSS 7.3 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-9800] A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to by…

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55412] ToolJet is the open-source foundation am AI-native platform for building and deploying internal tool…

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the A…

nvdaltovulnerabilidad CVSS 8.3 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-54033] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, Libr…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This…

nvdaltovulnerabilidad CVSS 7.7 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-9716] CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition…

CWE-476 NULL Pointer Dereference vulnerability exists that could cause a denial-of-service condition, rendering the device’s HMI and configuration functionality unavailable when malformed requests are received over exposed network interfaces.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-57235] Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, …

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-56122] Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthent…

Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any fi…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

25/06/2026

[CVE-2026-47147] In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-…

In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

25/06/2026

[CVE-2026-53198] In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a …

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL A deferred byte-range lock (an SMB2_LOCK that blocks) registers an async work on conn->async_requests via setup_async_work(), with cancel_fn = smb2_remove_blocked_lock and cancel_argv[0] pointing at the struct file_lock. When the request is cancelled, the w…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Crítico vulnerabilidad

25/06/2026

[CVE-2026-53176] In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs sho…

In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying…

nvdcriticovulnerabilidad CVSS 9.8 NVD