Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/07/2026

[CVE-2026-8396] Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS a…

Improper restriction of XML external entity reference vulnerability in Netcad Software Inc. NetGIS allows Serialized Data External Linking. This issue affects NetGIS: from 5.0.66 before 7.2.2.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-16014] A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unkno…

A vulnerability was found in code-projects Hospital Bed Management System 1.0. This affects an unknown part of the component Login Form. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-13410] Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The def…

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged access_token and user profile, and be l…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-11575] The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticit…

The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validate the callback signature is empty on sites configured through the current setup flow, so the expected signature reduces to an unkeyed hash of the request body that anyone can compute. This allows unauthenticated attackers to forge a payment-…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-11961] The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the members…

The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registration is one of the tiers allowed by the registration form before assigning that tier's associated user role, allowing unauthenticated users to register into an arbitrary published membership tier and obtain its role — up to administrator when such a tier exis…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-13765] The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vul…

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-13352] The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict C…

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 4.16.18 via the allowed_mime_types function. This is due to the unconditional registration of an upload_mimes filter that adds executable file extensions (.exe, .apk, .msi) to the …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-15395] The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored C…

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62387] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin: * as its default CORS configuration on all responses, including authenticated endpoints and preflight (OPTIONS) responses. Because the plugin accepts credentials via the Authorization and X-API-Token headers (set programmatically by JavaScript rather than via cookies), an attacker who obtains a va…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62234] Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users…

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62386] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through t…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62230] Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rul…

Grav before 2.0.4 ships a default .htaccess (and reference webserver-configs/htaccess.txt) whose rules blocking access to sensitive file types (.yaml, .php, .json, etc.) lack the [NC] flag, making extension matching case-sensitive. On case-insensitive filesystems (Windows/NTFS, macOS/HFS+, or Docker volume mounts), an unauthenticated attacker can request these files with uppercase or mixed-case ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62231] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the ow…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62232] Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin wher…

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF nonce to overwrite the 2FA secret with an attacker-chosen value, compute a valid TOTP code, and complete …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62233] grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and …

grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write managers to escalate to super-admin. Attackers can mint API keys bound to super-admin accounts or strip 2FA from super-admin users to achieve full instance takeover.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/07/2026

[CVE-2026-54340] h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there i…

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and pre…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-44435] Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server…

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 937d0e9, an assertion failure is raised when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing a Denial of Service. This issue has been fixed by commit 937d0e9.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-44453] h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is …

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memory allocated using alloca can be as huge as ~600KB, which exceeds the default pthread stack size used by…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-43977] wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated…

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-43978] wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can…

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. Once a trainer performs a legitimate switch into a low-privileged user, the session flag trainer.identity is set and this flag alone bypasses the permission ch…

nvdaltovulnerabilidad CVSS 8.1 NVD