Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48720] Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2025.03.05.08.02.stable_00 until 0.2026.05.06.15.42.stable_01, Warp accepts non-inline `OSC 1337;File` payloads from terminal output and materialize the decoded payload as a local file without an additional confirmation step. This vulnerability is fixed in 0.2026.05.06.15.42.stable_01.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

19/06/2026

[CVE-2026-53915] In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configu…

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

18/06/2026

[CVE-2025-52465] GeoServer is an open source server that allows users to share and edit geospatial data. Prior to ver…

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an abso…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-10303] In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not s…

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-39006] An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgS…

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-11527] Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via…

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather t…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

14/06/2026

[CVE-2026-11526] GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of…

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather than opened as a file. _ma…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-47643] External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute…

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35079] The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files…

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35080] The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local f…

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35076] The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local fi…

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35077] The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local …

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35078] The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local file…

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient validation of user-controlled input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10694] A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this iss…

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function include of the file /index.php. The manipulation of the argument page results in file inclusion. The attack can be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD