Altas · Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87795] zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompr…

zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes.

P Alto vulnerabilidad

09/09/2026

CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0308 PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (Severity: LOW). Tipo: Cross-Site Scripting (XSS). Producto afectado: PAN-OS.

P Alto vulnerabilidad

09/09/2026

CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0307 GlobalProtect App: Local Privilege Escalation Vulnerabilities (Severity: MEDIUM). Tipo: Escalación de Privilegios. Producto afectado: GlobalProtect.

P Alto vulnerabilidad

09/09/2026

CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0310 PAN-OS: Buffer Overflow Vulnerability via XML Processing (Severity: HIGH). Tipo: Desbordamiento de Búfer. Producto afectado: PAN-OS.

P Alto vulnerabilidad

09/09/2026

PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026)

Palo Alto Networks PSIRT publica advisory de seguridad: PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026) (Severity: HIGH). Tipo: Vulnerabilidad de seguridad. Producto afectado: Palo Alto Networks.

P Alto vulnerabilidad

09/09/2026

CVE-2026-0304 Cortex XDR Broker VM: Privilege Escalation Vulnerability

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0304 Cortex XDR Broker VM: Privilege Escalation Vulnerability (Severity: MEDIUM). Tipo: Escalación de Privilegios. Producto afectado: Cortex XDR.

P Alto vulnerabilidad

09/09/2026

CVE-2026-0305 Prisma Access Agent: Information Disclosure Vulnerability on Linux

Palo Alto Networks PSIRT publica advisory de seguridad: CVE-2026-0305 Prisma Access Agent: Information Disclosure Vulnerability on Linux (Severity: MEDIUM). Tipo: Divulgación de Información. Producto afectado: Prisma Access.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80099] Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because th…

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::g…

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80122] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87766] A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new ro…

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14359] The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in …

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['pa…

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14989] The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored…

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user access…

M Alto vulnerabilidad

09/09/2026

[CVE-2026-78491] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-78494] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-79636] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80123] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-75927] The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus…

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities…

M Alto vulnerabilidad

09/09/2026

[CVE-2026-83593] The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulner…

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user…

M Alto vulnerabilidad

09/09/2026

[CVE-2026-84068] The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before u…

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

M Alto vulnerabilidad

09/09/2026

[CVE-2026-76009] The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication By…

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?