Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-12421] The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field V…

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-14291] The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication f…

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ship…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-12082] The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of…

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64600] In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork map…

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-7232] The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter …

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-7534] The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scrip…

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16632] A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_proto…

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-38765] An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv…

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-38766] An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate priv…

An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the sub_186f4 function

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63684] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various ad…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63685] Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator r…

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-64791] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-64792] Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Re…

Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-64797] Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trus…

Joomla Extension - regularlabs.com - IP spoofing vulnerability in IP login extension - IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63265] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Re…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints - Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations out…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63280] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular La…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs conditions manager - Conditions administration did not consistently enforce tokens and component/mapped-item permissions.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63683] Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions man…

Joomla Extension - regularlabs.com - Client IP spoofing vulnerability in Regular Labs conditions manager - IP and GeoIP conditions trusted spoofable forwarded headers, allowing remote clients to bypass location-based rules.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-60835] An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13089] OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token…

OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-44090] An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and…

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

nvdaltovulnerabilidad CVSS 8.8 NVD