Alertas de Seguridad de la Información

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-59526] Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

Unauthenticated SQL Injection in MapSVG

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-59540] Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-57784] Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension <= 3.3.26 v…

Unauthenticated Cross Site Request Forgery (CSRF) in Ninja Forms File Uploads Extension

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-27064] Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.

Editor Arbitrary File Upload in Mailster

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-64873] Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could a…

Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-64874] Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN creden…

Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65431] Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives ha…

Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15015] The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypa…

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full admini…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-14282] The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Video…

The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart C…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15011] The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection v…

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possible for unauthenticated attackers to invoke arbitrary parameterless PHP functions, which can be used to d…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-16723] A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi…

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-64793] Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and …

Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-64796] Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free di…

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured inc…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-64798] Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL …

Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2025-50329] An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate…

An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-16624] Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to…

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-16606] A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before v…

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE beyond its CNA scope under existing agreement with Fujitsu Germany.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-2395] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-62144] An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security …

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a conf…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-62546] Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: We…

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework. While the vulnerability is in Oracle Applications Framework, attacks may significantly i…

nvdcriticovulnerabilidad CVSS 9.1 NVD