Alertas de Seguridad de la Información

M Alto vulnerabilidad

19/09/2026

[CVE-2026-76554] The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an im…

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-76790] The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several va…

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-85574] The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check wh…

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-85680] The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user suppli…

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to store JavaScript that will execute when any visitor, including an administrator, views their profile.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad alta de ejecución remota de código en plugin WP Photo Album Plus para WordPress

El plugin WP Photo Album Plus para WordPress es vulnerable a ejecución remota de código (RCE) en todas las versiones debido a sanitización insuficiente en nombres de archivo cargados. La vulnerabilidad reside en la función wppa_image_magick, donde escapeshellcmd() se aplica al comando completo en lugar de entrecomillar argumentos individuales antes de ejecutar comandos ImageMagick via exec(). Esto afecta directamente a sitios WordPress en México y Latinoamérica que dependen de este plugin para galerías de fotos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad XSS almacenado en plugin Asset CleanUp para WordPress afecta versiones hasta 1.4.0.5

El plugin Asset CleanUp: Page Speed Booster para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado que permite a atacantes no autenticados inyectar scripts maliciosos a través de comentarios. Los scripts se ejecutan cuando usuarios acceden a páginas comprometidas, afectando sitios web en México y Latinoamérica que utilizan este plugin para optimización de velocidad. Con CVSS 7.2, representa un riesgo alto para plataformas de comercio electrónico, portales corporativos y blogs que dependen de WordPress.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad XSS almacenado alta en SiYuan 3.8.4 permite ejecución de comandos del sistema

SiYuan versiones hasta 3.8.4 no sanitiza nombres de notebooks en el diálogo del selector de notas diarias, permitiendo inyección de HTML y JavaScript. Un atacante puede crear notebooks con payloads maliciosos que se ejecutan con acceso a Node.js en el renderer de Electron, comprometiendo la integridad del sistema operativo del usuario. El riesgo es alta (CVSS 8.8) para equipos que usan SiYuan como herramienta de documentación corporativa o gestión de conocimiento en entornos LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

Vulnerabilidad de XPS almacenado en SiYuan hasta versión 3.8.4 permite ejecución de código

SiYuan versiones 3.8.4 y anteriores no escapan correctamente atributos de estilo en encabezados al renderizar esquemas y marcadores, permitiendo inyección de XPS almacenado. Atacantes pueden suministrar notebooks maliciosos o explotar endpoints administrativos para ejecutar código malicioso en el renderer Electron con acceso total al sistema. Afecta principalmente a usuarios con sincronización de datos o ambientes colaborativos en LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-68928] Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.r…

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does not verify the caller. Any installed Android application can bind the service and send MSG_EXEC with an a…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-63446] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transact…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-63447] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-57228] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93872] Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restri…

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chains.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93868] Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.pas…

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account pas…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93031] The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordP…

The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported f…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84085] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84086] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84106] IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary c…

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84108] IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to imp…

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-84083] IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap…

IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation via the SUID-root nmap_wrapper binary on the Collector appliance. A local attacker with low-privileged access to the Collector can exploit insufficient argument validation in the SUID binary to execute arbitrary commands as root, resulting in full compromise of the Collector appliance.

nvdaltovulnerabilidad CVSS 7.8 NVD