Alertas de Seguridad de la Información

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8476] IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the …

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-45162] Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, multiple Pimcore locations call PHP's unserialize() on data from database columns and filesystem files without the allowed_classes restriction, including lib/Tool/Authentication.php, models/Site/Dao.php, models/DataObject/ClassDefinition/CustomLayout/Dao.php, models/Tool/TmpStore/Dao.php, models/Ass…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

16/07/2026

[CVE-2026-14890] SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable netw…

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-15008] The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for …

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the fr_token function in all versions up to, and including, 7.3.1.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47472] NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attac…

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could cause deserialization. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-24233] NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model we…

NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, unauthenticated attacker could cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50649] Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50646] Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local…

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-55944] Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execu…

Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50509] Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized…

Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45077] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist,…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-55009] Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev…

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54117] Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a…

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54118] Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a…

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50652] Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny …

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-12583] The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input tha…

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowing unauthenticated attackers to inject a PHP object and, via a property-oriented gadget chain bundled with the Newsletters WordPress plugin before 4.15, write arbitrary files and execute code on the server.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58233] SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a…

SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and ext…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-59521] Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr…

Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-free allows Object Injection.This issue affects Real Testimonials: from n/a through

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59518] Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec…

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-57770] Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all…

Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography allows Object Injection.This issue affects Grand Photography: from n/a through

nvdcriticovulnerabilidad CVSS 9.8 NVD