Alertas de Seguridad de la Información

J Alto vulnerabilidad

27/07/2026

[CVE-2026-66015] An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-p…

An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploitation may grant temporary platform administrator access.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-56748] Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 a…

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

27/07/2026

[CVE-2026-65616] Incorrect authorization validation in refresh token signature allows non-admin users to obtain a sig…

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-55578] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), ` (backtick), and the newline byte (0x0A) …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17568] Improper access control in the role membership management endpoint in Devolutions Server allows an a…

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66730] facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser…

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66731] facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked tran…

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17192] A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on …

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer net…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66394] SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanit…

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, e…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66050] NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer se…

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-66427] Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

Administrator SQL Injection in WP Google Review Slider

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59537] Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer…

Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59690] A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Objec…

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise.

nvdaltovulnerabilidad CVSS 8.0 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43871] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PH…

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17527] In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to p…

In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source n…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14837] Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH …

Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-13726] The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it…

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-12255] The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site…

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-13152] The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent …

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-15662] The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not r…

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal r…

nvdaltovulnerabilidad CVSS 8.6 NVD