Alertas de Seguridad de la Información

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-46386] OpenProject is open-source, web-based project management software. Prior to , the official openproje…

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fix…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-47193] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the j…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-32833] Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerabili…

Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code executio…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55441] mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feat…

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.4, mise's trust feature gates config files (mise.toml, .tool-versions) through trust_check, but task-include files are loaded on a path that never reaches it. When a directory has a task-include dir (mise-tasks/, .mise/tasks/, …) but no config file, mise falls back to the default includes and renders each task's tera f…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54341] Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a craf…

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-bounds read in DragonflyDB's listpack collection loaders, crashing the entire server process (SIGSEGV). Because DragonflyDB requires no authentication by default and RESTORE is a normal keyspace command, an unauthenticated remote attacker can crash the server w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-33646] mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .…

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise processes .tool-versions files through the Tera template engine during parsing, with the exec() function registered, enabling arbitrary command execution. Unlike .mise.toml files, .tool-versions files are not subject to trust verification in non-paranoid mode. This means an attacker can place a malicious .tool…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55677] Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagre…

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path (preserving %2F as-is), while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an attacker to bypass route-level access controls and read static files without authorization. This vuln…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56663] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. _is_ip_blocked() in backend/backend/util/request.py does not normalize IPv4-mapped IPv6 addresses before checking resolved IPs agains…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57518] Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users wit…

Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and insta…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2025-11919] The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` o…

The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directorie…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-0685] Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine …

Server side template inject (SSTI) in the expression evaluation component in Genshi Template Engine version 0.7.9 allows a remote attacker to achieve remote code execution (RCE) via crafted template expressions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-0828] Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11…

Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57662] Contributor SQL Injection in Contest Gallery <= 30.0.0 versions.

Contributor SQL Injection in Contest Gallery

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57663] Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.

Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57667] Sales Representative SQL Injection in Groundhogg <= 4.5 versions.

Sales Representative SQL Injection in Groundhogg

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57659] Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin <=…

Unauthenticated Cross Site Request Forgery (CSRF) in Paid Memberships Pro - Add Member From Admin

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57653] Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.

Contributor SQL Injection in WP Job Portal

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57655] Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-57658] Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

Administrator Arbitrary File Upload in TemplateSpare

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-57644] Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.

Contributor SQL Injection in Restaurant Menu by MotoPress

nvdaltovulnerabilidad CVSS 8.5 NVD