Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/10/2026

[CVE-2026-91828] The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not …

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-15897] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Bec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-10026] The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and inc…

The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insufficient input validation on the 'Feed Config' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-93367] The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated …

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page_title parameter of the ahcpro_track_visitor AJAX action. The action is registered for logged-out callers (wp_ajax_nopriv_ahcpro_track_visitor) and stores $_POST['page_title'] with NO sanitization, keeping it raw in …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104123] A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by th…

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104120] A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-e…

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch_url of the file mcp_server_fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be us…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103097] An API key is hardcoded and retrievable from the application package. Since Android applications can…

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103098] Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent…

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103096] API key is hardcoded and retrievable from the application package. Since Android applications can be…

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103766] ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated u…

ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission to inject SQL via the delete parameter in admin_area/ads_manager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries to extract user credentials and emails or modify and delete arbitrary records.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103761] Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in Transfer…

Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulnerability in TransferMetadata::receivePeerNotify that allows unauthenticated attackers to grow process memory without limit. Attackers can repeatedly send notify frames up to 1 MB to the handshake RPC port, filling the uncapped notifys vector until the out-of-memory killer terminates the engine.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-86344] A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operati…

A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-104051] PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated …

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the publicly visible file hash to retrieve the delete_code via the info API and then invoke the delete API …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-104020] Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote una…

Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value. To remediate this issue, users should upgrade to version 0.15.0 or later.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56661] GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler fetches a user-supplied URL with file_get_contents() after only format validation (FILTER_VALIDATE_URL) — there is no validation of the request destination. An attacker who can submit the form can make the server issue requests to arbitrary destina…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-53964] Document Merge Service is a document template merge service providing an API to manage templates and…

Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerab…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-54049] Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and vers…

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before 25.3, the Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML() directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversa…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103484] IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, whi…

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102667] Joyland AI app allows an attacker with shared network access to inject JavaScript into content loade…

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, mi…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-55230] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaS…

nvdaltovulnerabilidad CVSS 8.7 NVD