Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47139] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding pub…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when th…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47140] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangero…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47208] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox br…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.4.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47209] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in b…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the …

nvdaltovulnerabilidad CVSS 8.6 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-45674] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

nvdaltovulnerabilidad CVSS 8.7 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-46340] Netty is a network application framework for development of protocol servers and clients. In version…

Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragm…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47131] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has be…

nvdcriticovulnerabilidad CVSS 10.0 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-44893] Netty is a network application framework for development of protocol servers and clients. In netty-c…

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length belo…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-44894] Netty is a network application framework for development of protocol servers and clients. NoQuicToke…

Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from valida…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

12/06/2026

[CVE-2026-45416] Netty is a network application framework for development of protocol servers and clients. Prior to v…

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLengt…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-10557] The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical…

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation. The credentials provide access to cloud MQTT brokers carrying real-time telemetry for the entire global Yarbo robot fleet. They allow both wildcard subscription…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-12066] A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the functio…

A security flaw has been discovered in PbootCMS up to 3.2.12. This vulnerability affects the function retrieve of the file apps/home/controller/MemberController.php of the component Password Handler. The manipulation of the argument username/password/email/checkcode results in weak password recovery. It is possible to launch the attack remotely. The exploit has been released to the public and may …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-11849] The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnera…

The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50631] A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Toke…

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.4 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50632] A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lea…

A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50633] A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can…

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50645] There is no restriction on the amount of attachment headers that a message can contain when being de…

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue by imposing a maximum default of 500 attachments per message.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-49875] Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory w…

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50627] The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of inc…

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Routing attacks. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

12/06/2026

[CVE-2026-50628] A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP addres…

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD