Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12844] List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise functi…

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy with a single quadrupling (alloc

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-5305] The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin bef…

The Email Address Encoder WordPress plugin before 1.0.25, email-encoder-premium WordPress plugin before 0.3.12 does not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-49851] Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerabl…

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Mistune is vulnerable to a CPU exhaustion DoS due to superlinear (approximately O(n²)) behavior in parse_link_text. When parsing Markdown containing many consecutive [ characters, parse_link_text repeatedly scans the input using a regex search inside a loop. Each iteration re-scans a large portion of the remaining stri…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53077] In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB…

In the Linux kernel, the following vulnerability has been resolved: net/rds: Restrict use of RDS/IB to the initial network namespace Prevent using RDS/IB in network namespaces other than the initial one. The existing RDS/IB code will not work properly in non-initial network namespaces.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-34914] A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear…

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-34916] A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and ear…

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8379] The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce c…

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly enforce its nonce check on the file download handler, allowing unauthenticated attackers to download files uploaded by any user through the Frontend File Manager Plugin WordPress plugin through 23.6 by iterating identifiers.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-8163] The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some param…

The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statements, leading to a SQL Injection vulnerability exploitable by authenticated users with Subscriber-level access and above.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-54268] Angular is a development platform for building mobile and desktop web applications using TypeScript/…

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the len…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-8157] The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned…

The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST API endpoints, allowing authenticated users with a custom Vitepos WordPress plugin before 3.4.2 role to escalate privileges to administrator.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

19/06/2026

[CVE-2026-52908] In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure th…

In the Linux kernel, the following vulnerability has been resolved: RDMA: During rereg_mr ensure that REREG_ACCESS is compatible If IB_MR_REREG_ACCESS changes from RO to RW then the umem has to be re-evaluated to ensure it is properly pinned as RW. Since the umem is hidden inside each driver's mr struct add a ib_umem_check_rereg() function that each driver has to call before processing IB_MR_RER…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-34192] Software installed and run as a non-privileged user may conduct improper GPU system calls to cause a…

Software installed and run as a non-privileged user may conduct improper GPU system calls to cause an error path leading to UAF of GPU page tables. The vulnerability allows physical memory allocated for MMU page tables to be used after being freed. This was caused by an error path that would not cleanup properly before freeing the physical allocation.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-55237] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions prior to 0.6.62 have a DOM-based Cross-Site Scripting (XSS) vulnerability in AutoGPT's signup page. The application improperly trusts a URL parameter (`next`), which is passed to `router.push`. An attacker can craft a malicious link that, when opened by an authenticat…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-55202] Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during…

Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access the stats page by injecting a matching Host header or bypass detection via port manipulation. Remote attackers can trigger unauthorized access to internal proxy statistics or misroute requests as transparent proxy connections to circu…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-9570] The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before ech…

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-8089] The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommer…

The weMail: Email Marketing, Email Automation, Newsletters, Subscribers & Email Optins for WooCommerce WordPress plugin before 2.1.3 does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response, allowing unauthenticated attackers to deliver Reflected Cross-Site Scripting against any authenticated user (including administrator…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53849] OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature i…

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/06/2026

[CVE-2026-11527] Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via…

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or ends with a pipe ("| cmd", "cmd |") or begins with a redirect ("> path", ">> path") is run as a command or redirect rather t…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-48163] MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27…

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shel…

nvdaltovulnerabilidad CVSS 8.0 NVD