Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15240] The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching…

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-13178] The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts a…

The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated users to create orders marked as paid without completing any payment.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-13395] The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize…

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data such as password hashes from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12500] The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX a…

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12687] The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor …

The ProfileGrid WordPress plugin before 5.9.9.8 does not restrict which group an anonymous visitor may register into through its front-end registration, allowing unauthenticated users to register directly into a privileged group and be granted that group's configured role, up to Administrator when such a group exists, leading to privilege escalation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-1360] The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versio…

The BuddyPress plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 14.5.0 This is due to the `bp_unserialize_profile_field()` function using `@unserialize()` without the `allowed_classes` parameter on user-controlled XProfile field data. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject ar…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-14356] The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, a…

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any WordPress user, including administrat…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-48448] Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in a…

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to gain file system read access. Exploitation of this issue does not require user interaction. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-18017] Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute …

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-18012] Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17995] Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perf…

Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17989] Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar…

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17993] Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perfo…

Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.0 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17979] Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co…

Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17967] Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17969] Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote a…

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17971] Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attac…

Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17956] Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote …

Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17948] Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use…

Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17950] Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed …

Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a malicious file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD