Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7529] The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthori…

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-67623] Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to e…

Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can distribute or create a crafted repository containing a malicious fsmonitor entry to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17506] The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the …

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and including, 2.15.0. This is due to the get_cell_content() function applying urldecode() after esc_url() when rendering the URL column for 404 entries — a sequence that allows percent-encoded HTML to pass URL validation and then be reconstruc…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15979] The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable t…

The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to Arbitrary File Deletion via Path Traversal in versions up to and including 11.3.0. This is due to insufficient validation of the 'img_file' field within the cegg_data post metadata: the value passes only through wp_strip_all_tags() (which does not strip path traversal sequences), is stored directl…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16443] A flaw was found in the SAML metadata import functionality of the keycloak-services component, which…

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an un…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2025-70962] Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains ha…

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71294] Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that m…

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a `ci` POST parameter obtained via `cot_import('ci', 'P', 'TXT')` (trim-only sanitization) is passed to `unserialize(base64_decode($ci))` with no `allowed_classes` restriction, reachable by any member with write access to …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71284] Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_rest…

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting: `cmd = "cp {} {}".format(source, backup_path); ret_code = os.system(cmd)`. The only pre-check on the filename is a prefix/suffix match (startswith(backup_prefix), endswith(v…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71285] Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-…

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a block rendered on every public status page: `_paq.push(['setSiteId', ${escapedSiteIdHTMLAttribute}]);`. The escaping pipeline used (jsesc with isScriptContext:true, then html-escaper.escape()) does not esc…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71287] Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names usin…

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as `SLEEP(5)` passes through completely unmodified. The sanitized value is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71288] Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for…

Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation: `my @order_by = $input->multi_param('order_by'); foreach my $order (@order_by) { my $value = $input->param($order . "_ovalue"); $query_orderby = " …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71291] Bolt CMS renders content field values through Twig's full application-level Environment with no Sand…

Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue() calls shouldBeRenderedAsTwig(), which gates rendering only on the field definition's allow_twig flag and a regex checking for `{{`, `{%`, or `{#`; when true, the raw field value is compiled and rendered via `se…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71292] Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.ad…

Subrion CMS's admin grid sorting helper, _gridGetSorting() in includes/classes/ia.base.controller.admin.php, whitelists the `dir` (ASC/DESC) request parameter via in_array(), but falls back to the raw, attacker-supplied `sort` GET parameter whenever the requested key is not present in the per-controller $_gridSorting whitelist array: `$column = isset($this->_gridSorting[$params['sort']]) ? ... : $…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71276] Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query stri…

Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf() in both the PostgreSQL reader (readers/postgres/messages.go: `fmt.Sprintf("SELECT * FROM %s WHERE %s ...", format, cond)`) and the TimescaleDB reader (readers/timescale/messages.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71279] Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` paramet…

Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves `../` sequences, a name such as `../../tmp/evil.js` escapes the intended extensions directory. The extens…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71280] go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL us…

go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), IsPrivate(), IsUnspecified(), or IsLinkLocalUnicast() checks). An authenticated user creating or updating a bookmark via POST /api/bookmark, PUT /api/v1/bookmarks/cache, or POST /api/bookmarks/ext can s…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71281] Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~1…

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. Because torch.load() without weights_only=True performs full pickle deserializa…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71269] Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in pack…

Node-RED's local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path norma…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71270] Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with…

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page's HTML server-side and hands it, unsanit…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71271] Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP …

Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a w…

nvdaltovulnerabilidad CVSS 8.5 NVD