Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80099] Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because th…

Several Newfold plugins are vulnerable to Authentication Bypass. The vulnerability exists because the plugins bundle the wp-module-data module. In the module, the `authenticate()` method — registered on the `rest_authentication_errors` filter and therefore evaluated for every unauthenticated REST API request — performs an HMAC-style Bearer token comparison that degenerates when `HiiveConnection::g…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80122] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87766] A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new ro…

A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14359] The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in …

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['pa…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14989] The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored…

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_preference' parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user access…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-78491] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-78494] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-79636] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-80123] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-83593] The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulner…

The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-84068] The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before u…

The Quentn WP WordPress plugin before 1.2.15 does not adequately escape a request parameter before using it in an unprepared SQL query, allowing unauthenticated attackers to extract arbitrary data from the database via SQL injection.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-76009] The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication By…

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14962] The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and es…

The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks and extract arbitrary data from the database.

nvdaltovulnerabilidad CVSS 8.6 NVD

? Alto alerta

09/09/2026

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Four Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2025-25249, CVE-2026-19490, CVE-2026-87491, CVE-2026-20079.

cisaus-certalerta CISA KEV

M Alto vulnerabilidad

09/09/2026

[CVE-2026-84293] The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Script…

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-49314] OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of …

OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-49315] DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability …

DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-49310] Permission control vulnerability in the event notification module. Impact: Successful exploitation o…

Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-12855] Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in th…

Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-17553] The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and in…

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's bui…

nvdaltovulnerabilidad CVSS 7.2 NVD