Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-48768] TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/ge…

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to construct public/ S3 object keys, while issuing presigned PUT URLs that do not bind Content-Type. As a result, any anonymous visitor to a published bot with a file input can upload attacker-controlled HTML, SVG, or JS to att…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-45617] LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version…

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48759] TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Referenc…

TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modification and deletion. The handleSaveThemeTemplate and handleDeleteThemeTemplate handlers validate that the authenticated user is a non-guest member of the provided workspaceId, but then operate on themeTemplateId via Prisma queries that do …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53676] ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution …

ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-45357] LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In version…

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-8050] In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemB…

In SignalRGB versions prior to 1.3.7.0, seven of the thirteen IOCTL handlers dereference the SystemBuffer pointer without first verifying that it is non-NULL. Sending an IOCTL with an empty input buffer causes a NULL pointer dereference, resulting in a kernel crash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50196] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Discovery.Eureka prior to versions 4.2.0 and 3.4.0, `DataCenterInfo.FromJson` throws `ArgumentException` for any `name` value other than `"MyOwn"` or `"Amazon"`, despite the Java Eureka specification defining a third valid value: `"Netflix"`. The exception propag…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50200] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2.0 and Steeltoe.Management.EndpointCore prior to version 3.4.0, the `Sanitizer` component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default li…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48997] e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection v…

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six charact…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-50194] Steeltoe is an open source project that provides a collection of libraries that helps users build cl…

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints versions 3.2.2 through 3.3.0 and 4.1.0 are configured to listen on an alternate port (`Management:Endpoints:Port` is configured), the middleware responsible for restricting access to the endpoints uses the `Host` HTTP header rather than the…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12530] Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock Agent…

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK versions >= 1.1.3 and < 1.6.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments. To mitigate this issue, users should upgrade to version 1.6.1.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-48979] PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography…

PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-55202] Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during…

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circu…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54387] Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and…

Tinyproxy through 1.11.3, fixed in commit ff45d3b, fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backend to enable c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-54388] Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Cont…

Tinyproxy through 1.11.3, fixed in commit 364cdb6, fails to reject requests containing multiple Content-Length headers with differing values, forwarding all duplicate headers to the backend while using the first value to determine how many request body bytes to consume. Remote attackers can desynchronize the proxy and backend parser state, allowing injection of arbitrary HTTP requests to the backe…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-48814] Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP …

Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw d…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-11407] Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated adm…

Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perfo…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12529] A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Pr…

A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-55196] Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration…

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53871] Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cooki…

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.

nvdaltovulnerabilidad CVSS 8.1 NVD