Alertas de Seguridad de la Información

M Crítico vulnerabilidad

27/07/2026

[CVE-2025-50455] SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al…

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65700] h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that…

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The get_user_dir function in openai_server/backend_utils.py uses the bearer token string unsanitized as a path component via os.p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47752] Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2…

Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container. Versio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65431] Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives ha…

Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

N Crítico vulnerabilidad

22/07/2026

[CVE-2026-50252] In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended …

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming so…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65049] Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorizat…

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_a…

nvdcriticovulnerabilidad CVSS 9.3 NVD

A Crítico vulnerabilidad

21/07/2026

[CVE-2026-64609] Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is…

Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected. This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-63766] GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where AS…

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

20/07/2026

[CVE-2026-57308] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized sort parameters. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are r…

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

17/07/2026

[CVE-2026-8476] IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the …

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-40005] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process has write permissions with unsafe API. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-40008] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in …

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name and instantiates it using Class.forName().newInstance() without any validation or allowlisting. This issue affects Apache IoTDB: from 1.0.0 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15282] The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing …

The Instant Appointment plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'insapp_upload_image_as_attachment' function in all versions up to, and including, 1.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-59826] Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in vers…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-14345] The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress…

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_sho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58455] Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows…

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58457] Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command inj…

Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34101] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in text_file.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34102] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_i…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in job_info_get.php (line 16): SELECT * FROM jobs where input1 = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-34103] Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subti…

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in subtitles.php (line 16): SELECT id, filename, extension, type FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can perform error-based SQL injection to extract database contents.

nvdcriticovulnerabilidad CVSS 9.8 NVD