Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/07/2026

[CVE-2026-16585] The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress i…

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14490] The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to A…

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-17524] Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching m…

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first ext…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-61957] Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-65440] Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

Unauthenticated Cross Site Scripting (XSS) in GetGenie

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-63913] An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted r…

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2021-32086] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcod…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain pri…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2021-32088] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpo…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64775] A memory initialization issue was addressed with improved memory handling. This issue is fixed in iO…

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64725] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64703] A use after free issue was addressed with improved memory management. This issue is fixed in macOS S…

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64692] An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 a…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64541] In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_…

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64543] In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disabl…

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43813] A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 a…

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43777] This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8…

This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43771] A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia …

A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

J Alto vulnerabilidad

27/07/2026

[CVE-2026-66015] An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-p…

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-56748] Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 a…

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

27/07/2026

[CVE-2026-65616] Incorrect authorization validation in refresh token signature allows non-admin users to obtain a sig…

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

nvdaltovulnerabilidad CVSS 8.8 NVD