Alertas de Seguridad de la Información

A Alto vulnerabilidad

11/06/2026

[CVE-2025-46315] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 2…

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-24284] This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed i…

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-31272] The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may …

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48546] KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar…

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-49261] MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11…

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should…

nvdcriticovulnerabilidad CVSS 10.0 NVD

S Alto vulnerabilidad

11/06/2026

[CVE-2026-3329] A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user ac…

A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts in Sonatype Nexus Repository via authentication endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-46697] Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds…

Fediverse Embeds embeds fediverse posts on WordPress sites. Prior to version 1.5.8, Fediverse Embeds registered an unauthenticated REST route ftf/media-proxy (includes/Media_Proxy.php) with permission_callback => __return_true that accepted a base64-encoded URL and forwarded it to wp_remote_get($url) without enforcing any allowlist. The plugin's source contained a comment block explicitly acknowle…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-49982] tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a…

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.proto…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44492] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios …

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 …

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44494] Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the A…

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-44495] Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. …

nvdaltovulnerabilidad CVSS 7.0 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44496] Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on th…

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-44705] tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package conta…

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the config…

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44486] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale P…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44487] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44488] Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.…

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength desp…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

11/06/2026

[CVE-2026-7787] IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive i…

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

11/06/2026

[CVE-2026-7870] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified li…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/06/2026

[CVE-2026-9648] The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS cli…

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees. This oversight enables an attacker who compromises a name-constrained sub-CA to impersonate domains beyond its intended scope.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-53777] Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server t…

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, ca…

nvdaltovulnerabilidad CVSS 8.1 NVD