Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82908] A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is th…

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacte…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82914] A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability…

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82221] Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82224] Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in SliceWP

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82229] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81891] elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1…

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from mime.types, the staticMimeMap entries that map them to text/x-php are not appli…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81892] EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 an…

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81764] Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Essentials

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81765] Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81768] Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81291] Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Uncode

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81298] Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81290] Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-61641] Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before …

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverifi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-54598] Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo…

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-83497] Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch …

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-72001] Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated a…

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against ar…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-53553] Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traver…

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82815] A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file…

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79746] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key…

nvdaltovulnerabilidad CVSS 8.1 NVD