Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/09/2026

Vulnerabilidad alta en yast2-samba-client permite ejecución de comandos como root

Una falla de neutralización de caracteres especiales en yast2-samba-client (versiones hasta 5.0.4) permite a un atacante con control sobre un controlador de dominio Active Directory malicioso ejecutar comandos arbitrarios con privilegios root en máquinas siendo unidas al dominio. Afecta directamente servidores Linux en entornos corporativos que integran Active Directory, común en infraestructuras híbridas de LATAM con dominios Windows centralizados.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19573] The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via …

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19796] The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vul…

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19806] The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin …

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 1.4.52 via the `guest_ticket_login()` function and its `p` parameter. This is due to the site-wide AES-256-CBC encryption key being derived from only three two-digit `…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-19952] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due t…

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-conf…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-75921] The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widge…

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instea…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82957] A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the fu…

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82921] A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_typ…

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82922] A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects …

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82882] Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webho…

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin API tokens. Attackers with any authenticated account can query the endpoint with arbitrary project, environment, and application parameters to retrieve plaintext super-admin JWT tokens for full platform control.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82393] pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a t…

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-re…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82397] Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parse…

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-77348] Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the f…

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 (GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable") hardened endpoints/logos/search.php by disabling cURL proxying (CURLOPT_PROXY = '' + CURLOPT_NOPROXY = '*'). However, Wallos ships a second, near-identical, unauthenticated logo-image search endpoint — endpoints/…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82919] A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the func…

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of the file views.py of the component edit Endpoint. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-83596] A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to i…

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82392] pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package n…

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82908] A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is th…

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacte…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82914] A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability…

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82221] Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82224] Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in SliceWP

nvdaltovulnerabilidad CVSS 7.1 NVD