Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-39460] Usernames and passwords, including the default factory credentials, are stored in plaintext within t…

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP transfer from the web interface. A TFTP transfer can be initiated through SNMP which does not require authentication.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-29797] No authentication is required when updating firmware or bootloader, making it easy for malicious fil…

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 16 horas

[CVE-2026-107805] Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signatur…

Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume tempo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 17 horas

[CVE-2026-94067] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-94062] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad Nuevo

Hace 18 horas

[CVE-2026-104392] Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne…

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

Vulnerabilidad XSS alta en Basix NEX-Forms afecta formularios WordPress

Se ha identificado una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en Basix NEX-Forms versión 9.3.1 y anteriores, que permite inyectar código malicioso a través de formularios en WordPress. Esta falla afecta principalmente a sitios web en LATAM que utilizan este complemento popular para captura de datos y formularios de contacto. Un atacante podría comprometer sesiones de usuarios administrativos y robar información sensible de visitantes.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

Vulnerabilidad alta de suplantación de identidad en GiveWP 4.16.8.1 y anteriores (CVE-2026-96333)

Se ha identificado una vulnerabilidad de omisión de autenticación en GiveWP (plugin de donaciones de Liquid Web/StellarWP) que permite a atacantes suplantar identidades y acceder a funcionalidades administrativas sin credenciales válidas. Afecta versiones hasta 4.16.8.1. Esto es alta para plataformas de recaudación, ONGs y organismos públicos en LATAM que utilizan este plugin en WordPress.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-96329] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Blind SQL Injection.This issue affects tagDiv Opt-In Builder: from n/a through 1.7.6.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad Nuevo

Hace 21 horas

Inyección SQL ciega crítica en tagDiv Opt-In Builder versiones ≤1.7.6

Se ha identificado una vulnerabilidad de inyección SQL ciega (CVE-2026-96330, CVSS 9.3) en tagDiv Opt-In Builder que permite a atacantes ejecutar comandos SQL maliciosos sin validación adecuada de entrada. Esta falla afecta principalmente a sitios WordPress en México y Latinoamérica que utilizan este plugin para gestionar suscripciones y recopilación de datos. Un atacante podría extraer información sensible de bases de datos, comprometer credenciales o alterar registros críticos de clientes.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-95596] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-95599] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder allows Blind SQL Injection.This issue affects Taskbuilder: from n/a through 6.0.5.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-94167] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-94632] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-19575] The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in ke…

The user-mode verification handler for the device_deinit() system call, z_vrfy_device_deinit() in kernel/device.c, validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). k_object_validate() short-circuits its type comparison when the requested type is K_OBJ_ANY, so the check reduced to "this pointer is the base address of some kernel object the calling thread has been granted" — the o…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-81929] The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross…

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107910] An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in F…

An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is require…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107908] A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB b…

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-17189] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107318] @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. …

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path networ…

nvdaltovulnerabilidad CVSS 7.4 NVD