Alertas de Seguridad de la Información

M Crítico vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-103889] The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execut…

The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.16.2 via the 'xpv_image' parameter parameter. This is due to missing authentication and nonce checks on the wp_loaded handler combined with no sanitization of the xpv_image POST parameter before it is echoed unescaped into a Dompdf-rendered HTML template w…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-107645] The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, …

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_cu…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad Nuevo

Hace 5 horas

[CVE-2026-108263] Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the…

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/code_node.py when CODE_EXEC_TYPE is not explicitly changed. LocalExecutor supplies complete Python builtins to dynamic code execution without the docu…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad Nuevo

Hace 5 horas

[CVE-2026-108264] Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other medi…

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2 environment with application globals exposed. An authenticated user able to create steps, or an administrator …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad Nuevo

Hace 11 horas

[CVE-2026-105278] The published Docker image for openPDC includes a fixed administrative credential with no forced cha…

The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative control of the application.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 13 horas

[CVE-2026-86405] Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment…

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 13 horas

[CVE-2026-85531] Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment…

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 16 horas

Inyección SQL ciega en Ajax Search Pro afecta sitios WordPress en LATAM

Una vulnerabilidad crítica de inyección SQL (CVSS 9.3) en el plugin Ajax Search Pro para WordPress permite a atacantes ejecutar consultas SQL ciegas sin autenticación. Afecta versiones hasta 4.29.1 y representa riesgo severo para e-commerce, portales y sitios corporativos que usen este plugin en México y Latinoamérica, exponiendo datos de clientes y configuraciones de base de datos.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad Nuevo

Hace 16 horas

Inyección SQL ciega crítica en plugin WPLMS afecta sitios WordPress en LATAM

Se identificó una vulnerabilidad de inyección SQL ciega (CVE-2026-96327, CVSS 9.3) en VibeThemes WPLMS versiones anteriores a 1.9.9.8.2. Un atacante puede manipular comandos SQL a través de parámetros no sanitizados, comprometiendo bases de datos de sitios educativos y empresariales. Dado que WPLMS es popular en plataformas e-learning de México y LATAM, la exposición es significativa.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad Nuevo

Hace 20 horas

[CVE-2026-107909] A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_…

A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only boun…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad Nuevo

Hace 20 horas

[CVE-2026-107908] A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB b…

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-7826] A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/ser…

A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the re…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-5759] A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph …

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-16916] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-84244] IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cros…

IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An unauthenticated attacker who can influence monitored database traffic could execute malicious script in the browser of an authenticated Guardium user.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-104075] TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authenticat…

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web management login endpoint POST /tvu/Login that allows remote unauthenticated attackers to obtain an administrative session by submitting an empty or absent UserName parameter. Attackers can send a crafted HTTP request directly, bypassing client-side JavaScript val…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-104076] TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing auth…

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers can send unauthenticated GET requests to disclose network configuration, firmware details, and cloud s…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107703] @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that…

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107699] ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execut…

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to child_process.exec() in ppt2png.js, running commands with Node.js process privileges.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-95210] Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates cont…

Improper certificate validation in gnutls v3.8.13 causes the application to accept certificates containing invalid extensions.

nvdcriticovulnerabilidad CVSS 9.1 NVD