Alertas de Seguridad de la Información

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite ejecución remota de código

El plugin Grav API en versiones anteriores a 1.0.13 no valida correctamente los alcances de claves API en ConfigController, permitiendo a atacantes con permisos limitados inyectar comandos arbitrarios en la configuración del planificador de tareas. Esto resulta en ejecución remota de código a través de Symfony Process, afectando servidores web y sistemas de gestión de contenido en producción.

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49211] Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Auto…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause() builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards (%, _, \), allowing unauthenticated users to turn the public BaseEntityAutocompleteType endpoint into …

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

17/07/2026

[CVE-2026-49212] Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC comput…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-o…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48807] Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully c…

Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48805] Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/…

Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sandbox state to CoreExtension::checkArrow(), arraySome(), and arrayEvery(), allowing legacy calls such as twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() to bypass sandbox callable restrictions. This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-48806] Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping…

Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-46634] Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inn…

Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string_template__ name that can fall outside a SourcePolicyInterface sandbox decision, allowing a sandboxed template that can call template_from_string and include to render an inner template without security policy enforcement. This issue is fixed in version …

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46638] Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a templ…

Twig is a template language for PHP. Prior to 3.26.0, {% sandbox %}{% include %} can include a template that was previously loaded outside the sandbox without re-invoking checkSecurity(), allowing the cached template to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). This issue is fixed in version 3.26.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-46640] Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.(<string>) and import-alias dyn…

Twig is a template language for PHP. From 3.15.0 until 3.26.0, _self.() and import-alias dynamic attribute syntax can concatenate an attacker-controlled string into a MacroReferenceExpression name without identifier validation, causing raw PHP to be emitted into the generated template source and executed at template-load time. This issue is fixed in version 3.26.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-46633] Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quot…

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the compiled cache file. This issue is fixed in version 3.26.0.

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48489] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped f…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48736] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did n…

nvdaltovulnerabilidad CVSS 8.6 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45068] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45071] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-47767] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Fr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty($_GET), but parse_str() and the web SAPI can disagree, allowing a crafted query string to leave $_GET empty while $_SERVER['argv'] still carries attacker-controlled --env or --no-debug flag…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45304] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

nvdaltovulnerabilidad CVSS 7.5 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-45305] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in version…

nvdaltovulnerabilidad CVSS 7.5 NVD

S Crítico vulnerabilidad

14/07/2026

[CVE-2026-45069] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is …

nvdcriticovulnerabilidad CVSS 9.1 NVD