Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

XSS no autenticado alta en Brave Conversion Engine (PRO) versiones ≤ 0.8.6

Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) sin autenticación en Brave Conversion Engine (PRO) versiones 0.8.6 y anteriores, con CVSS 7.1. Esta falla permite a atacantes inyectar código malicioso que se ejecuta en navegadores de usuarios finales, comprometiendo sesiones y datos sensibles. Empresas en México y LATAM que utilizan esta herramienta para conversión de contenido o procesamiento de documentos están expuestas a ataques dirigidos y robo de credenciales.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28162] Unauthenticated Cross Site Scripting (XSS) in Events Made Easy <= 3.2.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Events Made Easy

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-28166] Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Tourmaster

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78213] Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authen…

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-77115] Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into pop…

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad XSS Reflejado alta en Combodo iTop 3.2.2 y anteriores

Combodo iTop, herramienta de gestión de servicios IT ampliamente utilizada en empresas LATAM, contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el API de búsqueda de claves foráneas con puntuación CVSS 8.8. Un atacante puede inyectar código malicioso en parámetros de búsqueda para ejecutar scripts en navegadores de usuarios administrativos, comprometiendo credenciales y acceso a datos altas de infraestructura IT. La vulnerabilidad afecta versiones anteriores a 3.2.3.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad alta en OpenSearch Dashboards permite ejecución de código JavaScript arbitrario

Una validación deficiente en el plugin dashboards-observability de OpenSearch Dashboards permite a usuarios autenticados con permisos de escritura ejecutar código JavaScript malicioso en sesiones de otros usuarios mediante carga de activos comprometidos. Esta vulnerabilidad afecta directamente plataformas de observabilidad y análisis de logs ampliamente usadas en infraestructuras cloud de LATAM, exponiendo datos sensibles de infraestructura, bases de datos y aplicaciones altas.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-61824] Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt a…

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts,…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-63135] YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS …

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30890] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-31803] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected …

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-31880] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30826] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30865] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30819] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-54682] DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with …

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.C…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-75933] Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and s…

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad XSS almacenado alta en WPForms Pro para WordPress

El complemento WPForms Pro para WordPress es vulnerable a inyección de scripts almacenados en campos de texto simple y párrafo (versiones hasta 2.0.0.2) debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Este riesgo es alta para sitios comerciales, de servicios y gobierno en LATAM que dependen de formularios para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-49436] LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API…

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrati…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-49825] lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attribute…

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

nvdaltovulnerabilidad CVSS 8.2 NVD