Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103921] GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.…

GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications using the executor directly, or url-loader with SubscriptionProtocol.LEGACY_WS, can therefore accept an attacker-controlled certificate when a…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-12405] A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in th…

A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job T…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-12423] A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable …

A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-101888] The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability t…

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemChe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79896] Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parse…

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-46729] NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener…

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-47360] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97273] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97277] Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Subscriber Broken Access Control in Social Boost

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97284] Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

Contributor PHP Object Injection in Icegram

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97297] Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Subscriber Broken Access Control in Gratisfaction

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97260] Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97268] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-94390] Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-95588] Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-67105] HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could al…

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79899] Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility…

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56589] HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, whic…

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-62073] Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

Unauthenticated Broken Access Control in WP Full Stripe Free

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103687] A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the f…

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD