Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Magistrala: Motor de reglas permite ejecución remota de código

El motor de reglas de Magistrala permite a usuarios autenticados crear reglas con scripts Go o Lua que se ejecutan en el servidor cuando llegan mensajes IoT. El intérprete Yaegi expone la librería estándar de Go completa (incluidos módulos os y net/http), permitiendo a atacantes autenticados ejecutar código arbitrario con acceso al sistema operativo. Esta vulnerabilidad afecta altas despliegues IoT en manufactura, utility y ciudades inteligentes en LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Grocy: inyección XSS a través de parser de solicitudes API

Grocy presenta una vulnerabilidad de inyección de scripts (XSS) en su analizador de solicitudes API (BaseApiController.php) que permite a atacantes eludir la purificación HTML mediante decodificación doble de entidades. Un adversario podría inyectar código malicioso que se ejecute en el contexto de aplicaciones que gestionen inventarios y despensas, comprometiendo datos sensibles de empresas pequeñas y medianas en México y LATAM que utilizan este software de código abierto.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71239] DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Dja…

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template() call; email_creators.py passes eml_message.subject directly as a template string to Template(); and helpers.py c…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Book-Management-System: endpoints Flask exponen datos de estudiantes sin autenticación

Los endpoints /student, /record, /books, /find_stu_book y /find_not_return_book carecen del decorador @login_required, permitiendo acceso no autenticado a información personal de estudiantes (nombre, género, estado de carné, deuda) e historial completo de préstamos mediante suministro de card_id. Afecta instituciones educativas y bibliotecas en LATAM que utilizan este sistema de gestión.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71232] MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP fu…

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71233] InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Larave…

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the t…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-12609] In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend expo…

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-25703] NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to m…

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7444] The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all …

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7520] The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of …

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7693] The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up t…

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_resto…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71209] audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-all…

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71211] MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/ser…

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full re…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71215] art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both…

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block '../' traversal sequences, …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71202] The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source …

The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, `width2 - offset_x` (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71206] Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and …

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a de…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-6147] The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t…

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-6627] The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unautho…

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hoo…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-6639] The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Informa…

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the `getCurrentTaskResults()` method in `modules/workspace/controller.php` being accessible without authentication or authorization checks. The method is not included in the workspace controller's `getNoncedMethods()` array, t…

nvdaltovulnerabilidad CVSS 7.5 NVD