Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-32444] Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Contributor Remote Code Execution (RCE) in Cwicly

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-32463] Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-28192] Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-75783] A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulner…

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-75874] Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 …

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-74990] Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. …

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunder…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-74979] Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Fir…

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-74956] Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Fir…

Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-74938] Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Fire…

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica en ArcadeDB permite eludir controles de autenticación en versiones 26.7.3 y anteriores

ArcadeDB server no propaga correctamente el usuario autenticado a threads de trabajo asincrónico, permitiendo a atacantes con acceso de lectura ejecutar comandos con permisos elevados. Esta vulnerabilidad afecta principalmente a empresas en LATAM que utilizan ArcadeDB en entornos de producción para gestión de datos críticos, comprometiendo la integridad de la información almacenada.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica en ArcadeDB: autenticación SASL no aplicada en protocolo MongoDB

ArcadeDB versiones anteriores a 26.8.1 no valida credenciales SASL en comandos de datos del plugin MongoDB wire-protocol. Atacantes no autenticados pueden ejecutar inserciones, búsquedas, actualizaciones, eliminaciones y creación de bases de datos conectando al puerto 27017 sin credenciales. Afecta infraestructuras que exponen este servicio en empresas de LATAM con bases de datos sensibles.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica de autenticación en ArcadeDB anteriores a 26.8.1 (CVE-2026-75854)

ArcadeDB versiones anteriores a 26.8.1 presentan una vulnerabilidad crítica (CVSS 9.8) en el plugin de protocolo Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto Redis y ejecutar comandos arbitrarios contra cualquier base de datos del servidor sin proporcionar credenciales. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan ArcadeDB en entornos de producción con acceso a redes inseguras o expuestas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica en ArcadeDB <26.8.1 permite ejecución de código JavaScript sin autorización

ArcadeDB anterior a la versión 26.8.1 no vincula correctamente el principal autenticado en el executor de transacciones gRPC, permitiendo a usuarios autenticados ejecutar comandos JavaScript sin validación de permisos. Los atacantes pueden crear cuentas administrador a nivel servidor explotando la ejecución no restringida de comandos, comprometiendo completamente la confidencialidad e integridad de bases de datos en infraestructuras críticas de LATAM.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica en Grav anterior a 2.0.14 permite escalada de privilegios a super-admin

Grav antes de la versión 2.0.14 no valida correctamente el campo de acceso en el blueprint de grupos, permitiendo que operadores con permisos de admin.users escalen privilegios a super-admin. Esto habilita acceso a funciones críticas como evaluación Twig y scheduler, comprometiendo la integridad de sitios web en producción. El impacto afecta especialmente a portales corporativos y plataformas de contenido en empresas mexicanas y latinoamericanas que hospedan instancias de Grav.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-75627] Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unaut…

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-75626] SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s…

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-15748] The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up …

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-75094] A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /…

A flaw has been found in COMFAST CF-N1-S 2.6.0.1. This impacts the function sub_44B438 of the file /cgi-bin/mbox-config?method=SET&section=ptest_ssid of the component CGI Interface. This manipulation of the argument ssid causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-71424] Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers …

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_se…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-64849] MLflow is an open source AI engineering platform for agents, large language models, and machine lear…

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated addr…

nvdcriticovulnerabilidad CVSS 9.3 NVD