Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/06/2026

[CVE-2026-10823] The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST …

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and does not validate a user-supplied query parameter, allowing unauthenticated attackers to retrieve the titles and content of private, draft, and other non-public posts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-10835] The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a para…

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 7.7 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-55967] AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were no…

AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12844] List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functi…

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-5305] The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin bef…

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-49851] Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining stri…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53077] In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB…

In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in network namespaces other than the initial one. The existing RDS/IB code will not work properly in non-initial network namespaces.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-34914] A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear…

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-34916] A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and ear…

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

23/06/2026

[CVE-2026-9733] Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state…

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time (which is leaked via the HTTP Date header) and a call to Perl's built-in rand function. A predictable state allows an atta…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8379] The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce c…

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8163] The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some param…

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54268] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the len…

nvdaltovulnerabilidad CVSS 7.5 NVD

I Crítico vulnerabilidad

22/06/2026

[CVE-2026-12628] IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.…

IBM Storage Protect Client 8.1.0.0 through 8.2.1.0 and IBM Storage Protect Snapshot For Windows 8.1.0.0 through 8.2.1.0 could allow a remote attacker to bypass authentication due to the use of a hardcoded credential in the FlashCopy Manager (FCM) authentication mechanism. The application contains a static credential embedded in multiple authentication code paths, and does not properly validate aut…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/06/2026

[CVE-2026-11373] Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Clien…

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values are not sanitised for newlines or other protocol control characters such as colons or pipes, allowing metric injections.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-8157] The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned…

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2026-9265] Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8…

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent hea…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2026-11551] The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all ve…

The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.29. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their ac…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

19/06/2026

[CVE-2026-52908] In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure th…

In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_RER…

nvdaltovulnerabilidad CVSS 7.8 NVD