Alertas de Seguridad de la Información

U Alto vulnerabilidad

02/07/2026

[CVE-2026-54401] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57761] Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57766] Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 ver…

Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57757] Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57758] Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 ve…

Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57759] Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid <= 5.9.9.7 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in ProfileGrid

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57751] Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-57348] Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.

Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-11946] An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service …

An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM ind…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

02/07/2026

[CVE-2026-8147] In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoint…

In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` ha…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-33592] An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service i…

An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3.9 GB) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-14249] The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and incl…

The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopr…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-50160] Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from ve…

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-57723] Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS al…

Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.12.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58454] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-20191] A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arb…

A vulnerability in Cisco Catalyst Center could allow an unauthenticated, remote attacker to read arbitrary files from a restricted container.&nbsp; This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to read arbitrary files …

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

01/07/2026

[CVE-2026-24242] NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side …

NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53903] MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servl…

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53904] MCO is vulnerable to Account Denial of Service due to improper implementation of password reset func…

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset pro…

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

01/07/2026

[CVE-2026-14181] @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the st…

@fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js p…

nvdaltovulnerabilidad CVSS 7.5 NVD