Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/09/2026

[CVE-2026-85677] The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordP…

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visito…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-87908] multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1…

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-73784] A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML respons…

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-73785] A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote un…

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-74925] The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capab…

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89060] A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster id…

A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89161] In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a c…

In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-81754] The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPres…

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-81825] The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cros…

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including,

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-19991] The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and inc…

The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-18579] The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'H…

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The n…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-15462] The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields'…

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_form_data' AJAX action in versions up to, and including, 1.4.2. This is due to the save_form_data() function passing attacker-controlled POST array keys unsanitized to $wpdb->insert(), which wraps column identifiers in backticks without escaping them, allowing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-18561] The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'ad…

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbati…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78130] strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certifi…

strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78132] strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parse…

strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78133] libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handlin…

libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-78134] strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins bec…

strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-77807] The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugi…

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84889] IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-86093] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

nvdaltovulnerabilidad CVSS 7.5 NVD