Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90947] A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Eff…

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to open a malicious preset file, potentially causing a crash or enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2023-32803] The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not pr…

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certificates from the root store. NOTE: this issue exists because of an incorrect fix for CVE-2022-23491.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-80071] The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may…

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing authenticated users with Author-level access and above to assign themselves an arbitrary role and escalate their privileges to Administrator.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-84047] The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parame…

The Album Cover Finder WordPress plugin through 0.7.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-80491] The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input befor…

The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-89212] A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references we…

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-14560] The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded fi…

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-86093] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88899] knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in t…

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88937] knowns through 0.33.0 fails to properly validate template destination paths in the code generation t…

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-64838] ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and r…

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process into the web-accessible project directory, disclosing file contents and deleting originals.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

Vulnerabilidad alta en GeoVision GV-LPC2211 V1.13 permite denegación de servicio en conexiones PTZ

GeoVision GV-LPC2211 versión 1.13 presenta una gestión inadecuada del estado de conexión PTZ (Pan-Tilt-Zoom) que permite a un atacante remoto no autenticado bloquear el bucle de aceptación y prevenir nuevas conexiones PTZ. Esta vulnerabilidad afecta sistemas de vigilancia altas en instalaciones de seguridad física en México y Latinoamérica, donde estas cámaras son ampliamente deployadas en bancos, hospitales y centros comerciales.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-14873] The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeo…

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details like arbitrary user passwords, including administrator passwords, to a known plugin-configured custom value, enabling full account takeover of the site…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86751] Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing auth…

Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server files and issue server-side HTTP requests. Attackers can submit markdown image syntax in checkout acceptance notes that survive HTML escaping, are expanded by CommonMark parser, and resolved by laravel-mail-auto-embed via file_get_contents or curl, exfiltrati…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86754] Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allo…

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes for bearer tokens inheriting full admin API permissions lasting up to 40 years.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-86199] PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline …

PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

Vulnerabilidad alta en GitPython anterior a 3.1.60 permite ejecución de código arbitrario

GitPython versiones anteriores a 3.1.60 no valida correctamente la ubicación del directorio git, permitiendo que atacantes suplanten directorios git mediante archivos rastreados (gitdir, commondir, HEAD) e inyecten hooks maliciosos de pre-commit. Al ejecutar index.commit() en repositorios clonados o abiertos, se dispara código arbitrario en el contexto del usuario afectado, comprometiendo servidores de CI/CD, máquinas de desarrolladores y sistemas de control de versiones en empresas LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14962] The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and es…

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-85983] The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This …

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81994] Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes (…

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious fi…

nvdaltovulnerabilidad CVSS 8.2 NVD