Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-14257] brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()…

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65896] Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate …

Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversa…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65497] Administrator PHP Object Injection in Complianz <= 7.5.0 versions.

Administrator PHP Object Injection in Complianz

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65461] Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.

Administrator Arbitrary File Upload in Really Simple CSV Importer

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65462] Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions.

Administrator SQL Injection in Uncanny Automator

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65455] Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.

Administrator Arbitrary File Upload in MapSVG

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-59545] Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

Unauthenticated Broken Authentication in miniOrange Discord Integration

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-57784] Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 v…

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-57427] Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock <= 1.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Download Monitor - WPForms Lock

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64611] A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite l…

A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-64874] Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden…

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15015] The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypa…

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full admini…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-15017] The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions…

The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the `MDJM_Permissions::set_permissions()` and `MDJM_Employee_Manager::init()` functions, combined with the absence of server-side allow-list validation on the `employee_roles[]` and `new_role` POST par…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-14282] The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Video…

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart C…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-12421] The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field V…

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-14291] The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication f…

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ship…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-7232] The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter …

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-7534] The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scrip…

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16632] A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_proto…

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of…

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …

nvdaltovulnerabilidad CVSS 8.0 NVD