Alertas de Seguridad de la Información

M Crítico vulnerabilidad

24/09/2026

Vulnerabilidad crítica de escalada de privilegios en plugin Paytium para WordPress

El plugin 'Paytium: Mollie payment forms & donations' para WordPress contiene una vulnerabilidad de escalada de privilegios (CVSS 9.8) en versiones hasta 5.0.3 que permite a atacantes eludir mecanismos de validación de firmas y obtener privilegios administrativos. Afecta directamente a tiendas de e-commerce, plataformas de donaciones y sistemas de pago integrados con Mollie en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96751] A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a081…

A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96762] A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the fu…

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosur…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96603] A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_lo…

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release syst…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96604] A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the functi…

A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96601] A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of t…

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version informati…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96602] A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file…

A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-75887] A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal …

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-19125] The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all version…

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96556] A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function …

A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not res…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-6935] IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executabl…

IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96889] A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincl…

A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94183] Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page…

Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84714] A flaw was found in the automation-controller input-validation guard sanitize_jinj…

A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject user-supplied Jinja, but the patterns stop at the first interior '}' or '%' character, so a Jinja expression containing an inner brace (for example an empty dict) is accep…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-84719] A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplat…

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the instance_groups (and execution_environment and labels) that were preserved from the original. A user with organization workflow-admin permiss…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84691] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that f…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string formatting permits attribute and item traversal on its arguments, an administrator can craft a template that w…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-75884] A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist th…

A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96541] A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can o…

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is clos…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-95515] Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94174] Administrator SQL Injection in Email Log <= 2.63 versions.

Administrator SQL Injection in Email Log

nvdaltovulnerabilidad CVSS 7.6 NVD