Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/09/2026

[CVE-2026-62089] Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse…

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78807] An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper netwo…

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-72710] SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where t…

SPIP before 4.4.18 contains a remote code execution vulnerability in the editer_objet action where the arg parameter resolves SQL table names without enforcing an editable columns allowlist, allowing attackers with a valid nonce to inject attacker-controlled rows into the spip_jobs table. Attackers can supply arg=job/0 with crafted fonction and args values, which are later unserialized and execute…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89260] MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback …

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter ent…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89065] Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 m…

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the version-controlled generated file manifest that is consumed during project synthesis. To remediate this …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89066] Improper neutralization of special elements used in an OS command in the task synthesis component in…

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To rem…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-68497] jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGrego…

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and n…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-89010] WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticat…

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string vi…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-82578] When XML batch processing is turned on and the XPath option is selected, the raw batch input goes th…

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPath/JAXP setup with no entity restrictions, so XXE injection can allow data exfiltration and denial-of-service attacks.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-82583] NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute ar…

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78224] The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, …

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38056] A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmwar…

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured l…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38058] The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, i…

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89212] A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references we…

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-71416] Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, th…

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-57842] NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPA…

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

11/09/2026

Vulnerabilidad XSS almacenado alta en AVideo plugin Bookmark (CVE-2026-89256)

AVideo contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el plugin Bookmark que permite a propietarios de videos inyectar código malicioso a través del parámetro de nombre de capítulo. Los nombres de capítulos no se codifican antes de insertarse en el HTML de la página pública, causando que todo visitante ejecute el payload en el origen de AVideo. Con CVSS 8.7, afecta plataformas de streaming y repositorios de video frecuentes en empresas e instituciones educativas de LATAM.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

11/09/2026

Vulnerabilidad crítica en Hugo v0.161.0+ permite ejecución de código mediante TailwindCSS

Hugo, generador de sitios estáticos, ejecuta herramientas Node con permisos insuficientemente restringidos desde la versión 0.161.0. TailwindCSS, incluido en la lista de seguridad por defecto, requiere configuraciones altamente permisivas (--allow-addons, --allow-child-process, --allow-worker) que permiten eludir controles de seguridad previos. Esto afecta a empresas en LATAM que alojan sitios web con Hugo y utilizan TailwindCSS para compilación de estilos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

Vulnerabilidad alta de lectura de archivos sin autenticación en WWBN AVideo (CVE-2026-89250)

WWBN AVideo contiene una vulnerabilidad de lectura de archivos sin autenticación en el endpoint getRecordedFile.php que expone archivos de video grabados en FLV desde el directorio temporal. Atacantes pueden descargar archivos de video en vivo sin validación de autenticación utilizando claves de stream conocidas o adivinadas. Este riesgo afecta principalmente a plataformas de streaming y educación en línea en LATAM que utilizan esta solución para transmisiones en vivo.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

Vulnerabilidad XSS almacenado alta en WWBN AVideo (CVE-2026-89253)

WWBN AVideo contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el campo de perfil 'donationLink' que permite a usuarios autenticados inyectar código malicioso. La validación insuficiente en la función setDonationLink() acepta URLs malformadas con cargas de script. Afecta principalmente a plataformas de streaming y educación en línea que utilizan este software en servidores locales o en la nube en LATAM.

nvdaltovulnerabilidad CVSS 8.7 NVD