Alertas de Seguridad de la Información

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17349] /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, wh…

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every column from the source row, including user_id, shared, shared_username, and the stored credential fields password, save_password, and tunnel_password. When a non-owner triggered an adhoc connect against…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17351] The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist…

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's defau…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-17346] The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pg…

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and subscription names sourced from pg_catalog via the browser tree could never contain an apostrophe. Po…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-18358] A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is …

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-62391] The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server…

The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allowlist via unprefixed Spark config aliases. This issue affects Apache Kyuubi: from 1.6.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-16843] Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insuf…

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-11770] A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search …

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-15722] A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_fro…

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a repl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-65313] A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations …

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-65310] ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes …

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-16236] The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up …

The Realtyna Organic IDX plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 5.3.0. This is due to missing file extension and content validation in the saveLiveImages() function combined with an insufficient authorization check on the get_keys() AJAX handler and a missing authentication check on the REST API import endpoint. This makes it possible for auth…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-18452] DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauth…

DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14930] The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or owners…

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-15048] The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its A…

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14830] The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout …

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-13392] The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget d…

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-supe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-14483] The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary Fi…

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installation…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63223] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload valid…

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-63222] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without …

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.

nvdaltovulnerabilidad CVSS 7.5 NVD