Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-15212] The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up t…

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-25800] Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting …

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a `RecvStream` in order (through an `AsyncRead` impl for example) will be…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-63765] Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads control…

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16756] Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the de…

Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to cause a denial of service by opening many connections and sending partial requests that are never completed, exhausting server sockets and tasks. To mitigate this issue, users should upgrade to aws-smithy-http-ser…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65918] PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vul…

PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to memcpy. Attackers can supply malicious or truncated GIF files to cause denial of service via segmentation fault or disclose adjacent heap memory contents.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-6516] Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code …

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65701] SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability …

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side path…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47668] DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner …

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-47743] Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to ta…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47752] Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2…

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Versio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-44909] Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A re…

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65917] CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDO…

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference (IDOR) vulnerability in the IncBackups application's incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) that allows authenticated panel users to access or manipulate other tenants' backup resources by supplying an attacker-controlled globally sequential IncJob integer ID th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65916] CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in…

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16584] Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 migh…

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on …

nvdaltovulnerabilidad CVSS 7.0 NVD

C Alto vulnerabilidad

23/07/2026

[CVE-2026-65898] DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an u…

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as s…

nvdaltovulnerabilidad CVSS 7.2 NVD

S Crítico vulnerabilidad

23/07/2026

[CVE-2026-65688] Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner…

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Crítico vulnerabilidad

23/07/2026

[CVE-2026-65689] Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner…

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full…

nvdcriticovulnerabilidad CVSS 9.8 NVD

S Alto vulnerabilidad

23/07/2026

[CVE-2026-65690] Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner…

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside the intended directory by supplying a crafted filename. Attackers can exploit this path traversal weakness to execute arbitrary commands with high privileges on the server. The vulnerability is specific …

nvdaltovulnerabilidad CVSS 8.8 NVD

S Crítico vulnerabilidad

23/07/2026

[CVE-2026-65687] Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner…

Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying a crafted request. Attackers can exploit this path traversal weakness to disclose sensitive server files, including authentication credentials, enabling full un…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-14257] brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()…

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count …

nvdaltovulnerabilidad CVSS 7.5 NVD