Alertas de Seguridad de la Información

D Alto vulnerabilidad

16/06/2026

[CVE-2026-12161] Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permis…

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50875] Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows aut…

Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modify or delete another tenant's webhook via a crafted request.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20084] WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities…

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitra…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2019-25746] WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows au…

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53831] OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowli…

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47366] Improper verification of access permissions when modifying permissions through the Administration Co…

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48546] KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar…

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions an…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2026-44494] Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the A…

Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack — intercepting, reading, and modifying all HTTP traffic including authentication credentials…

nvdaltovulnerabilidad CVSS 8.7 NVD

L Alto vulnerabilidad

11/06/2026

[CVE-2026-7787] IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive i…

IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50131] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify pre…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting in version 0.11.2 and prior to versions 1.9.12, 1.10.11, 2.0.19, 2.1.15, and 2.2.4 appears incomplete.…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-42462] Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to v…

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to versions 1.9.11, 1.10.10, 2.0.18, 2.1.14, and 2.2.3, an attacker can make use of JSON-LD features to restructure a JSON-LD document that would change how Fedify interprets it without changing its Linked Data Signature, allowing them to alter a third-party signed activity they have received. Versions …

nvdaltovulnerabilidad CVSS 7.0 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52758] Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user…

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52754] Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authen…

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Attackers can escalate privileges, modify repository access controls, exfiltrate shared reverse engineering databases, and permanently compromise …

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-52755] Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that …

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

nvdaltovulnerabilidad CVSS 7.8 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26239] A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gai…

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-8863] Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker wit…

Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36806] Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflo…

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formModifyWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36809] Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflo…

Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-36797] Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in…

Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain a stack overflow in the IPMacBindRuleIp parameter of the formIPMacBindModify function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 7.5 NVD