Vulnerabilidades · "Ni" — Alertas SI

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52919] In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counte…

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix tp_meter counter underflow during shutdown batadv_tp_sender_shutdown() unconditionally decrements the "sending" atomic counter. If multiple paths (e.g. timeout, user cancel, and normal finish) call this function, the counter can underflow to -1. Since the sender logic treats any non-zero value as "still sending"…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9178] The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up…

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST route wp/v3/user/list/ (callback userDetail()) with permission_callback set to '__return_true', and the function's home-grown authentication only verifies that the supplied 'Username' HTTP header maps to an administrator account and that a '…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12417] The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Re…

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability …

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10091] The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'email' shortcode in all versions up to, and including, 1.03 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wi…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10092] The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scriptin…

The Cincopa video and media plug-in plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cincopa Shortcode in Post Comments in all versions up to, and including, 1.163 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. …

M Alto vulnerabilidad

24/06/2026

[CVE-2026-10735] Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress pl…

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 were distributed with malicious code throug…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12846] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12847] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12848] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

M Crítico vulnerabilidad

24/06/2026

[CVE-2026-12485] GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled ove…

GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a service running by default on the IOBox listening for UDP messages on port 10001. Any user on the network can send messages to this service and interact with it. Upon receiving a UDP message, the server reads at most 1460 bytes into a local buffer and a po…

M Alto vulnerabilidad

24/06/2026

[CVE-2026-3652] The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parame…

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute whenever an administrator views the "P…

M Alto vulnerabilidad

23/06/2026

[CVE-2026-56785] FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where na…

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or da…

M Crítico vulnerabilidad

23/06/2026

[CVE-2026-54588] Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4…

Poweradmin is a web-based DNS administration tool for PowerDNS server. Versions prior to 4.2.4 and 4.3.3 use the attacker-controlled `HTTP_HOST` request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the `redirect_uri` sent to the Identity Provider, causing the IdP to re…

F Alto vulnerabilidad

23/06/2026

[CVE-2026-54512] jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson …

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains …

F Alto vulnerabilidad

23/06/2026

[CVE-2026-50193] jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson …

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if (and only if) the service reads deeply nested (1000s of levels) JSON as JsonNode (ObjectMapper.readTree()) and writes out same (or modifided) node using JsonNode.toString(). This …

R Alto vulnerabilidad

23/06/2026

[CVE-2026-12112] A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server all…

A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in…

M Alto vulnerabilidad

23/06/2026

[CVE-2026-54328] Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or…

Pi is a minimal terminal coding harness. From 0.74.0 until 0.78.1, Pi versions with temporary npm or git extension package installs used predictable paths under the operating system temporary directory. On Linux-based multi-user systems, a local attacker who can write to the shared temporary directory could prepare the expected package location before another user runs pi with a temporary extensio…

M Alto vulnerabilidad

23/06/2026

[CVE-2026-54555] rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the …

rtk filters and compresses command outputs before they reach your LLM context. Prior to 0.42.2, the permission splitter did not conservatively split or reject several shell constructs that Bash treats as command execution boundaries or nested execution. As a result, a command beginning with an allowed prefix such as git could hide a second command behind one of these constructs. rtk rewrite return…

T Crítico vulnerabilidad

23/06/2026

[CVE-2026-48491] Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity…

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientC…

T Crítico vulnerabilidad

23/06/2026

[CVE-2026-53622] Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerabilit…

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?