Alertas de Seguridad de la Información

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-52778] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability e…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11393] Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI be…

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collab…

nvdcriticovulnerabilidad CVSS 9.0 NVD

L Crítico vulnerabilidad

08/06/2026

[CVE-2026-46289] In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length cal…

In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in extract_iter_to_sg()", v3. Fix bugs in the kvec and user variants of extract_iter_to_sg. This series is growing due to useful remarks made by sashiko.dev. The main bugs are: - The length for an sglist entry when extracting from a kvec c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-39910] STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low…

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-41448] AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability t…

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-25555] OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key aut…

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints witho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-46440] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This issue has been patched in version 3.1.2.

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-46441] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating an assistant resource. Due to missing server-side validati…

nvdcriticovulnerabilidad CVSS 9.6 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-46442] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbo…

nvdcriticovulnerabilidad CVSS 9.9 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-44631] Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configur…

Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-42535] A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to d…

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-42861] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to modify server-controlled properties such as workspaceId, createdDate, and updatedDate when updating a variable resource. Due to missing server-side validation …

nvdcriticovulnerabilidad CVSS 9.6 NVD

A Crítico vulnerabilidad

08/06/2026

[CVE-2026-29167] Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration Thi…

Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11499] A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function…

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2023-54352] WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attack…

WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2024-58348] WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that a…

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2024-58349] WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauth…

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico amenaza

07/06/2026

Alerta ThreatFox: Agentemis,BEACON,CobaltStrike,cobeacon activo — 958 IOCs (07 de June de 2026)

ThreatFox (abuse.ch) detectó 958 IOCs de Agentemis,BEACON,CobaltStrike,cobeacon (Post-Exploitation Framework) en las últimas 24h. Tipos: 451 IP de Comando y Control (C2), 507 Dominio malicioso. Nivel: CRITICO.

threat-intelthreatfoxioc Editorial

A Crítico amenaza

07/06/2026

Alerta ThreatFox: RemcosRAT,Remvio,Socmer activo — 187 IOCs (07 de June de 2026)

ThreatFox (abuse.ch) detectó 187 IOCs de RemcosRAT,Remvio,Socmer (RAT (Troyano de Acceso Remoto)) en las últimas 24h. Tipos: 180 IP de Comando y Control (C2), 7 Dominio malicioso. Nivel: CRITICO.

threat-intelthreatfoxioc Editorial

B Crítico vulnerabilidad

05/06/2026

[CVE-2026-45779] OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerabil…

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allows an unauthenticated remote attacker to execute arbitrary SQL statements. Exploitation requires no authentication or user interaction and can result in complete compromise of the underlying database. All deployments of Open XDMoD prior to 1…

nvdcriticovulnerabilidad CVSS 9.8 NVD