Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13756] The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-42952] Previously, there was no throttling on repeated authentication attempts to the charging station bac…

Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55659] Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-…

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when openin…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-45196] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which can lead to privilege escalation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-45203] Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmwar…

Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory write outside the permitted range of memory for the host kernel. A TOCTOU bug existed where a malicious driver could modify values in memory after firmware validation but before use.

nvdaltovulnerabilidad CVSS 7.8 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55452] Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the…

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header and ReportsController::postActivityReport() writes that value to the Activity Report CSV without formula escaping, allowing a low-privileged authenticated user to store a formula-like User-Agent that may execute when a report viewer opens the exported CSV in spreadsheet so…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55466] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. T…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61460] Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadControlle…

Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController that allows authenticated users to edit, update, or delete records owned by other users. Attackers can modify CRM records and reassign ownership by exploiting missing record-level ownership validation in edit, updat…

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

10/07/2026

[CVE-2026-61461] Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend th…

Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55516] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance record and asset but then fills attacker-controlled fields including asset_id without re-authorizing the newly supplied asset, allowing an authorized user to move a maintenance record onto an asset outside their company scope. This issue is …

nvdaltovulnerabilidad CVSS 7.7 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-54329] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path m…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while company_id is mass assignable, allowing a low-privileged authenticated user in one company to create accessory records under another company when Full Multiple Companies Support is enabled. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 8.5 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55460] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

C Alto vulnerabilidad

10/07/2026

[CVE-2026-53448] Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTT…

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.12.0, the coturn HTTPS admin panel passes HTTP query parameters directly into SQL queries via snprintf string interpolation without sanitization. The is_secure_string filter that protects the STUN protocol path is not applied to the admin panel's delete-user, delete-secret, and delete-IP operations, so an authenticated…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56667] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and S…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reach…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55672] ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2…

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

nvdaltovulnerabilidad CVSS 7.4 NVD

E Alto vulnerabilidad

10/07/2026

[CVE-2026-59162] Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.1…

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55687] ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.…

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Versions 6.0.1, 5.5.4, 5.4.4, 5.3.5, and possibly prior contain an out-of-bounds write in jpeg_parse_dqt_marker() in components/esp_driver_jpeg/jpeg_parse_marker.c because the attacker-controlled DQT marker Tq nibble is used as an index into the qt_tbl array without validating that it is in the range 0..3, allowing malformed …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39244] adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated u…

adm-zip before 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. In zipEntry.js line 103, Buffer.alloc(_centralHeader.size) allocates memory based on the declared uncompressed size from the ZIP central directory header without validating it against the actual compressed data size or imposing any upper bound. The size value is read d…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-53657] Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on…

Lima launches Linux virtual machines, typically on macOS, for running containerd. Prior to 2.1.3, on an instance of Lima running with the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock when the guest agent is enabled, which could result in running arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addre…

nvdaltovulnerabilidad CVSS 8.2 NVD