Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8442] The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions u…

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected pre…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49061] Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40779] Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.

Contributor Arbitrary File Deletion in Link Library

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40769] Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File…

Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40727] Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.

Sales Representative Arbitrary File Deletion in Groundhogg

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50877] An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying f…

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20081] WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows una…

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20076] WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attacker…

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive file…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12198] A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path …

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor w…

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

13/06/2026

[CVE-2026-11769] We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity secur…

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6961] Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mat…

Mattermost versions 11.6.x

nvdaltovulnerabilidad CVSS 7.6 NVD

L Alto vulnerabilidad

12/06/2026

[CVE-2026-3840] A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a c…

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11846] The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File D…

The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories,  resulting in data destruction or service disruption.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47368] A malicious actor with access to the network could exploit a Path Traversal vulnerability found in c…

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to obtain data from such UniFi OS devices or instances.

nvdaltovulnerabilidad CVSS 8.6 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45171] Incomplete input validation and improperly configured folder permissions within Idira Privileged Ses…

Incomplete input validation and improperly configured folder permissions within Idira Privileged Session Manager (PSM) versions prior to 15.0.3, 14.6.3, 14.2.5, and 14.0.5, an authenticated, low-privileged user could potentially execute arbitrary code. CyberArk Security Bulletin: CA26-17 and CA26-18

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-49982] tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a…

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value (Array, Buffer, or any object) whose includes('..') returns falsy but whose stringification still contains ../. The value flows through Array.proto…

nvdaltovulnerabilidad CVSS 8.2 NVD

R Alto vulnerabilidad

11/06/2026

[CVE-2026-44705] tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package conta…

tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package contains a path traversal vulnerability that allows escaping the intended temporary directory when untrusted data flows into the prefix, postfix, or dir options. By embedding traversal sequences (e.g., ../) or path separators in these parameters, attackers can cause files to be created outside the config…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-53777] Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server t…

Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server to write arbitrary content to any location writable by the running process by supplying unsanitized path components in the artifact_name field of ArtifactReady WebSocket messages. Attackers controlling the server URL can deliver traversal payloads through the artifact_name or download_path fields, ca…

nvdaltovulnerabilidad CVSS 8.1 NVD

K Alto vulnerabilidad

11/06/2026

[CVE-2026-11816] Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction ut…

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `filter_safe_zipinfos()` validate archive member paths against the process current working directory (CWD) instead of the actual extraction destination. When the process runs with CWD set to `/`, which is …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-40987] A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client file…

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

nvdaltovulnerabilidad CVSS 7.1 NVD