Alertas de Seguridad de la Información

M Alto vulnerabilidad

20/07/2026

[CVE-2026-47198] Paymenter is a free and open-source webshop solution for management of hosting services. In versions…

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because bundled server extensions prioritize these user-supplied properties over administrator-defined configurati…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-64193] Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. N…

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt-…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-64194] Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer cha…

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service. The guard `$link < $offset` preven…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-62414] Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla ext…

Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The Joomla extension Page Builder CK does not properly apply access control to frontend page list views.

nvdcriticovulnerabilidad CVSS 9.1 NVD

N Alto vulnerabilidad

20/07/2026

[CVE-2026-54538] xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the …

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted packet that forces the xrdp process or thread into an infinite, CPU-bound loop. B…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Crítico vulnerabilidad

20/07/2026

[CVE-2026-41252] xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp,…

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds check in xrdp, which allows a heap-based buffer overflow when operating in vnc-any mode. The issue occurs during the handling of RFB protocol color map messages from a VNC server, where incoming color indices are not properly validated. A malicious VNC server can exploit this flaw by sending crafted messages with…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-13577] Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules a…

Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absol…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-6656] Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_passwor…

Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks. The check_password method uses the built-in eq operator. This allows discrepancies in timing to be used to guess the underlying hash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-9833] The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does…

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of a logged-in user with `edit_pages` capability (Editor or higher) who is tricked into follow…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-16235] Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These ver…

Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2024-58368] SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API r…

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server.

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

17/07/2026

[CVE-2026-52746] JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs t…

JSONata is a JSON query and transformation language. Prior to 2.2.0, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-12693] Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Pla…

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-12694] Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Func…

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-14741] HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in p…

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounded quantifiers next to each other before a trailing `\s*$` anchor. A valid date prefix followed by a long interior run of digits, letters, o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/07/2026

[CVE-2026-51080] libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External …

libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-7189] Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's…

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-13410] Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The def…

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be l…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-11575] The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticit…

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62226] OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act…

OpenClaw 2026.3.28 before 2026.5.19 contain an authorization bypass vulnerability in the browser act route that fails to properly validate current-tab URL checks. Attackers with lower-trust access or configured input paths can perform actions requiring stronger authorization or policy checks.

nvdaltovulnerabilidad CVSS 8.5 NVD