Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/09/2026

[CVE-2026-67549] OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format…

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.1.16.0, A crafted 1-bit contiguous cmyk tiff is exposed through a native uint1 imagespec, so callers allocate a bit-packed buffer. tiffinput::read_native_scanline_locked() nevertheless invokes tiffinput::bit_convert() with 8-bit output and writes one expanded…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93658] uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before f…

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93604] vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embed…

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']). The builtin sanitizer (sanitizeCryptoModule in lib/builtin.js) replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper used to expose the host module does not localize side effects…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93593] ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types becaus…

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite explicit deny rules by exploiting the missing type-name-based access check that causes permission lookups to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad XPS almacenado en Popup Maker para WordPress afecta versiones hasta 1.24.0

El plugin Popup Maker para WordPress es vulnerable a inyección de scripts (XSS almacenado) en el parámetro values[Name] hasta la versión 1.24.0, permitiendo que atacantes sin autenticación inyecten código malicioso en páginas públicas. Esta vulnerabilidad (CVSS 7.2) afecta directamente a tiendas en línea y sitios de generación de leads en LATAM que usan este plugin para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

Vulnerabilidad de elusión de autorización en Master Addons for Elementor hasta v3.2.2

El plugin Master Addons for Elementor para WordPress es vulnerable a elusión de autorización en todas las versiones hasta la 3.2.2, permitiendo que atacantes autenticados con rol de colaborador ejecuten acciones no autorizadas. Esta vulnerabilidad afecta especialmente a agencias web, diseñadores freelance y empresas en LATAM que utilizan Elementor para gestionar sitios corporativos. Con CVSS 8.1, representa un riesgo alto para la integridad y confidencialidad del contenido.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-87774] The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter…

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-87775] The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter…

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-81810] The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability…

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the expor…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85122] The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted va…

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93371] A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue aff…

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c52…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-87886] Local privilege escalation due to insecure file permissions. The following products are affected: Ac…

Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54671] WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an…

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54612] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Edi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54506] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forb…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-93393] A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built wi…

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to, or an attacker able to impersonate or redirect the client's connection, can cause the driver to write attacker-supplied data outside the bounds of a heap allocation while processing incoming encrypted traffic. No aut…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-50125] MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes th…

MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-54504] MCP Documentation Server is a local-first document management and semantic search server for AI codi…

MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the automatically started Web UI in src/server.ts calls startWebServer in src/web-server.ts with START_WEB_UI enabled by default and WEB_PORT set to 3080. startWebServer uses app.listen(PORT) without a host, which binds the unauthenticated document-management API…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-52727] lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch…

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-86039] libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @lib…

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ID derived by RecordEnvelope.openAndCertify. The expectedPeer option checks only the envelope signer, a…

nvdaltovulnerabilidad CVSS 8.2 NVD