Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/09/2026

[CVE-2026-84099] The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a …

The wpstorecart WordPress plugin through 5.0.7 does not prevent direct, unauthenticated access to a bundled add-on that deserializes user-supplied input without restricting the permitted classes, allowing unauthenticated attackers to inject arbitrary PHP objects, which may be escalated further when a suitable gadget chain is present on the site.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/09/2026

[CVE-2026-82845] The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metad…

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP objects and, by way of a class shipped in a library bundled with the Masteriyo LMS WordPress plugin before 3.4.1, write and execute arbitrary code on the server. A weaker form of the s…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/09/2026

Vulnerabilidad crítica en GitLab EE permite acceso a credenciales sensibles (CVE-2026-87719)

GitLab Enterprise Edition presenta una falla de seguridad en versiones 18.3 a 19.3.1 que permite a usuarios autenticados con acceso a Duo Chat obtener configuraciones de Advanced Search y credenciales sensibles mediante argumentos GraphQL especialmente diseñados. La vulnerabilidad afecta principalmente a empresas LATAM que utilizan GitLab EE para almacenar código crítico y secretos de aplicaciones. Con puntuación CVSS 9.9, esta falla requiere atención inmediata en infraestructuras de DevOps.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-62103] Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

Unauthenticated PHP Object Injection in Everest Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-62105] Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-62107] Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

Unauthenticated PHP Object Injection in Masteriyo - LMS

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-73699] FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated atta…

FileRun before 2026.3.0 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary code by exploiting incorrect options passed to unserialize() in the Perms::getPerms() method, where a positional array is used instead of the required named-key array to disable class instantiation. Attackers with database write access can inject a serialized gadget chain …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81784] Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.

Unauthenticated PHP Object Injection in Wise Chat

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-82925] The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized…

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such insta…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87874] A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although…

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a n…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87930] MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, …

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve code execution if gadget classes exist.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2024-58381] PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processin…

PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-81385] Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to e…

Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-77484] Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a…

Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69694] Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authoriz…

Deserialization of untrusted data in Windows IP Address Management (IPAM) Service allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-65772] Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute…

Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-47297] Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over…

Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12744] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12745] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote unauthenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-12648] A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a …

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD