Vulnerabilidades · "Multiple Vendors" — Alertas SI

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107219] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, agile decryption accepts an attacker-controlled spinCount and performs that many password-key derivation iterations before verifier validation. OpenFile reaches agileDecrypt, which passes the unbounded spinCount to convertPasswdToKey before password verification. When a crafted OLE encrypt…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107217] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0 in github.com/xuri/excelize/v2 and from 1.1.0 to 1.4.1 in github.com/xuri/excelize, ColumnNameToNumber accumulates a bijective base-26 value in int64 without detecting overflow, allowing an invalid long column name to wrap to zero with no error. ColumnNameToNumber accepts the overflowing na…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-106164] In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, a…

In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists when importing an XLS file with a specifically-targted corruption, the import timeout is ignored resulting in an unresponsive CPU thread and denial of service.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-96335] Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured …

Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107214] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, the decryption dispatch performs insufficient structural and parameter validation before standard and agile decryptors slice, index, allocate, and divide using attacker-controlled values. Decrypt passes attacker-controlled EncryptionInfo and EncryptedPackage data into standardDecrypt or ag…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107215] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.3.1 to 2.11.0, extractPart allocates a byte slice directly from an attacker-controlled CFB directory-entry size before validating the sector chain or size domain. extractPart trusts the CFB directory entry streamSize for EncryptionInfo and EncryptedPackage allocations before validating the stream. When a…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107216] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, ANCHORARRAY recursively calls the exported CalcCellValue function, creating a fresh calculation context at each cycle and bypassing in-flight and iteration controls. ANCHORARRAY calls CalcCellValue instead of cellResolver, so each recursive hop receives a new calcContext and loses cycle st…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-107212] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 t…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized…

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-95605] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82.

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-95606] Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows…

Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-94662] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-94670] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-95534] Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Element…

Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Object Injection. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

M Alto vulnerabilidad

07/10/2026

[CVE-2026-95595] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly disable-remove-google-fonts allows Reflected XSS. This issue affects Disable and Remove Google Fonts | GDPR & DSGVO friendly: from n/a through 2.0.2.

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-76501] A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (…

A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a denial of service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM and SR…

M Alto vulnerabilidad

07/10/2026

[CVE-2026-76484] As part of Cisco's ongoing commitment to proactive security and product quality, the engineering tea…

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-202…

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-76485] A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS…

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker c…

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-76486] A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS…

A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as NGOAM, could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges or cause a Denial-of-Service (DoS) on an affected device. This vulnerability is due to improper input validation of IP traffic when the NGOAM feature is enabled. An attacker c…

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-76498] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Applicati…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76498 are related to imprope…

M Crítico vulnerabilidad

07/10/2026

[CVE-2026-76499] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Applicati…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Application Policy Infrastructure Controller (APIC) engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76499 are related to imprope…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?