Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/06/2026

[CVE-2026-5416] Due to the improper neutralization of special elements used in a name parameter a low privileged rem…

Due to the improper neutralization of special elements used in a name parameter a low privileged remote attacker can exploit a command injection vulnerability in the Managed Ethernet Switch, resulting in full system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8176] The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab…

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-39490] Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

Unauthenticated Broken Access Control in JupiterX Core

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-39581] Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.

Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-52711] Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

Unauthenticated Broken Access Control in WooCommerce POS

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-52712] Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.

Subscriber SQL Injection in Attendance Manager

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-39437] Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <…

Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2025-68045] Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.

Unauthenticated Broken Access Control in WP Event SOlution

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8444] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' …

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'curselrevs[]' parameter of the wpfb_find_reviews AJAX action in versions up to, and including, 12.6.8. This is due to the handler reading $_POST['curselrevs'] raw with no sanitization or type casting, then concatenating each array element directly into a `WHERE id IN ( ... )` clause without quoting and executing …

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-46331] In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial CO…

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-6933] The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing auth…

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' par…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8443] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 's…

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded arra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-7273] A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versi…

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

16/06/2026

[CVE-2026-12161] Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permis…

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48723] The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on Browse…

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52694] Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52695] Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52697] Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Subscriber SQL Injection in Taskbuilder

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52699] Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar

nvdaltovulnerabilidad CVSS 7.5 NVD