Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/08/2026

[CVE-2026-16623] The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before…

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-61523] WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that …

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69088] Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::…

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-fi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-16144] The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote C…

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-53510] Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates atta…

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-13392] The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget d…

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-supe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-61536] Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3,…

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Py…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17922] Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote …

Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54661] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54662] swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t…

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject T…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54664] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject c…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-54666] swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior…

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execu…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-55415] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling thr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54653] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.17.0 until 0.60.2, datamodel-code-generator preserves attacker-controlled default_factory values in src/datamodel_code_generator/parser/jsonschema.py through JsonSchemaObject.init and get_field_extras and emits the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54654] datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodel_code_generator/model/template/TypeAliasAnnotation.jinja2, src/datamodel_code_generator/model/template/TypedDict.jinja2, src/datamodel_code_generator/model/template/dataclass.jinja2, src/datamodel_code_gene…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54655] datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.6…

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodel_code_generator/parser/jsonschema.py in _get_python_type_override are inserted into generated field annotations without sufficient validation, allowing attacker-controlled JSON Schema content to execute Python code when the generated module is importe…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54656] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in src/datamodel_code_generator/model/pydantic_v2/base_model.py through _process_validators into @field_validator decora…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54621] datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, Grap…

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodel_code_generator/model/template/UnionTypeStatement.jinja2 and src/datamodel_code_generator/model/template/UnionTypeStatement.py312.jinja2 are rendered into Python comments without neutralizing carriage returns in Python # comments, allowing attacker-contro…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-66745] Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixa…

Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the att…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-66748] Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerabil…

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_…

nvdaltovulnerabilidad CVSS 8.8 NVD