Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81291] Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Uncode

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81296] Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81297] Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81298] Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81287] Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

Subscriber SQL Injection in Charitable

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81290] Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-61641] Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before …

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallos is configured against an IdP that lets a user present an arbitrary or unverifi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-54598] Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpo…

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php executes database schema migrations when called over HTTP with zero authentication. Any unauthenticated attacker can trigger pending migration files against the live SQLite database. This issue has been patched in version 4.9.4.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-13732] A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/sta…

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a linked list removal bug in the code that separates destructor and non-destructor member functions of C++ classes. The bug causes the destructor entries to remain in the main function list while the list length counter is decremented, resulting in an out-of-bounds write when the f…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-83497] Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch …

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-72001] Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated a…

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token verification call. Attackers holding a single valid share link for any resource can authenticate against ar…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-53553] Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traver…

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82815] A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file…

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of the component Middleware. This manipulation of the argument X-Forwarded-For/X-Real-IP/True-Client-IP causes improper access controls. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did n…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79746] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79747] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue server-side requests to it, with no egress filtering (no block of loopback / RFC1918 / link-local 169.254.0.…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79750] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.30, MCPHub scopes non-admin users to servers they own (list views and config edits enforce ownership), but the tool-execution API does not. Any authenticated non-admin user can invoke tools on MCP servers owned by othe…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79744] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.29, MCPHub's PUT /api/system-config endpoint (handler updateSystemConfig) performs no authorization check. It is protected only by the app-wide authentication middleware and a rate limiter — it never inspects req.user.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79745] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, the built-in prompt and resource controllers perform no role checking. The mutating POST/PUT /api/prompts* and POST/PUT /api/resources* routes are attached to the authenticated router with no admin gate, and the ha…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82808] A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impac…

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand ab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-17615] A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker…

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitiv…

nvdaltovulnerabilidad CVSS 7.5 NVD