Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/08/2026

[CVE-2026-19084] The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when cr…

The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-19423] The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection whe…

The Ultimate Member WordPress plugin before 2.13.0 does not validate a submitted role selection when it cannot resolve the set of roles a profile form permits, and screens the value against the site's registered role names rather than against the form's own allow-list, allowing unauthenticated users who register through the Ultimate Member WordPress plugin before 2.13.0's own form to grant thems…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-70331 Microsoft Edge for iOS Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

edgespoofing Microsoft MSRC

G Alto vulnerabilidad

28/08/2026

CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft publica advisory de seguridad: CVE-2026-66324 Microsoft Edge (Chromium-based) Spoofing Vulnerability. Tipo: Suplantación (Spoofing).

edgespoofing Microsoft MSRC

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76053] The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulner…

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-77365] The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin f…

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-18983] The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site S…

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpua_action_process_option_update function. This is due to insufficient file type validation in wp_handle_upload() called without a MIME allow-list, with post-write validation relying on the attacker-controlled client-supplied Content-Type…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-18324] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vuln…

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-18978] The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Co…

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A comment payload crafted exclusive…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-38820] openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injec…

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-38821] A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenti…

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-38822] In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the au…

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-82072] Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-78037] Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. A…

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76940] The affected Ebyte device does not restrict repeated authentication attempts through rate limiting …

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76945] The affected Ebyte device relies on client-managed authentication tokens without sufficient server-…

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-77977] Ebyte gateway product's vendor configuration utility does not require authentication before allowin…

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75813] Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthor…

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-75814] The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the…

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-76060] An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionalit…

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD