Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/06/2026

[CVE-2026-9848] The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query par…

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_author_search_results()` when the current request is an unauthenticated front-end search. That function reads `$query->query_vars['s']` — al…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-49396] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.0.14, cross-site GET request can trigger stored cron commands on a victim's agents. This issue has been patched in version 2.0.14.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-45012] ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29…

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-50108] The Naxclow platform API that returns device relay registration details exposes a persistent credent…

The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can retrieve credentials for arbitrary devices and register on the relay as that device, enabling interception and disruption of its communications.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-42947] A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind …

A flaw in Naxclow's platform’s onboarding workflow allows an attacker to replay a confirm-then-bind sequence to silently reassign a device to an arbitrary account. Because the affected endpoints validate request signatures but do not confirm legitimate ownership, an attacker with any account can take over a device without user interaction while the device remains online and unaware.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-7387] Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mat…

Mattermost versions 11.6.x

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50087] The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerabili…

The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerability, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50088] The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.…

The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit cross-origin request sharing, which is an instance of "CWE-942: Permissive Cross-domain Policy with Untrusted Domains," and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N (8.2 High).

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

12/06/2026

[CVE-2026-50631] A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Toke…

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and generate multiple valid Access Tokens, when 'recycleRefreshTokens' is set to false. A leaked refresh token can be replayed concurrently by multiple attackers or threads. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-45418] ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authentic…

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different files and change their title (English, Spanish...). The POST /actions/subtitle_edit.php request used to change their title includes a number parameter which is vulnerable to SQL Injection. A boolean-based blind SQL injection c…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

11/06/2026

[CVE-2026-53812] OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control th…

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered redirects and subsequently read restricted page content using browser evaluation capabilities.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-53782] Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers w…

Summarize before 0.17.0 contains a server-side request forgery vulnerability that allows attackers who control a podcast RSS feed to direct the host to fetch transcript content from loopback addresses, link-local addresses, RFC 1918 private ranges, or other reserved destinations by supplying malicious podcast:transcript URL values. Attackers can bypass protections through DNS rebinding and redirec…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-46622] SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authe…

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_tokens database table. Any attacker who obtains read access to the database — through SQL injection, a leaked backup, a misconfigured replica, or insider access — immediately obtains all API credentials for every user with no f…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48547] KanaDojo contains a command injection vulnerability that allows an attacker with pull request access…

KanaDojo contains a command injection vulnerability that allows an attacker with pull request access to execute arbitrary shell commands by inserting shell metacharacters into the version or changes fields of patchNotesData.json, which are interpolated unsanitized into a child_process.execSync() call in the release.yml workflow. Attackers can have a malicious pull request merged to trigger the Git…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-47170] Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-ho…

Garlic-Hub manages digital signage network — devices, content, and playlists — from a single self-hosted interface. Prior to version 1.1, authenticated users can cause the server to issue arbitrary HTTP requests to internal services via the uploadFromUrl endpoint. This allows internal port scanning, service fingerprinting, and retrieval of internal HTTP responses which are stored in the publicly a…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48546] KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar…

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions an…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44492] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios …

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-44495] Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1…

Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. …

nvdaltovulnerabilidad CVSS 7.0 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44486] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale P…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44487] Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’…

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer pr…

nvdaltovulnerabilidad CVSS 7.5 NVD