Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56709] Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function whe…

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56702] Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUp…

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-34968] Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the data…

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-66766] SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial o…

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78284] Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

Unauthenticated Arbitrary File Deletion in MasterStudy LMS

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78263] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78264] Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78268] Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat But…

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78282] Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-77384] libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the re…

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @lib…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78259] Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

Unauthenticated Broken Authentication in WPLegalPages

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-32560] Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Gen…

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-32561] Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

Subscriber Privilege Escalation in Booking Hub

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-32556] Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Boost

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-7455] A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Wri…

A maliciously crafted FLT file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-77567] Filament is a collection of full-stack components for accelerated Laravel development. Prior to vers…

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-16783] A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Wri…

A maliciously crafted ABC file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-19568] A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption …

A maliciously crafted SVG file, when parsed through Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76098] Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vul…

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.render_token() can exceed Python's recursion limit and raise RecursionError, allowing crafted Markdown to crash a parsing pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-61419] Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A …

Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.8 NVD