Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94487] Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94174] Administrator SQL Injection in Email Log <= 2.63 versions.

Administrator SQL Injection in Email Log

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94176] Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94179] Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94181] An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the brows…

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a element that triggers requestFullscreen without displaying the fullscreen notification.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-94124] Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Contributor SQL Injection in WP EasyCart

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93622] Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93773] Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Contributor SQL Injection in Mollie Forms

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93774] Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93526] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93527] Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

Contributor SQL Injection in Live Copy Paste for Elementor

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84486] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views t…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user (including unauthenticated clients) and are routed in production builds because their URL include is not gated on the debug setting. An unauthenticated remote attacker can repeatedly invoke these endp…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-84499] A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions o…

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum len…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77601] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77423] JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine bu…

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier exp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76648] CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get…

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For J…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77394] OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or mor…

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77422] JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine bu…

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-75131] NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability t…

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76086] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integra…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while …

nvdaltovulnerabilidad CVSS 8.5 NVD