Alertas de Seguridad de la Información

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-6382] The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4…

The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have th…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-58422] Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-8927] When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configur…

When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`.

nvdcriticovulnerabilidad CVSS 9.1 NVD

H Crítico vulnerabilidad

03/07/2026

[CVE-2026-8925] The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice…

The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-9725] The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Ar…

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57100] Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an au…

Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-52830] fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer…

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legac…

nvdcriticovulnerabilidad CVSS 9.4 NVD

N Crítico vulnerabilidad

02/07/2026

[CVE-2026-38968] ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacki…

ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-59099] Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthen…

Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remote unauthenticated attackers to recover plaintext conversation state by exploiting AES-GCM initialization vector reuse across the server lifetime. Attackers can collect multiple client-side webflow execution tokens from the unauthenticated login page and perform known-plaintext analysis to decrypt the webflow …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58466] AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthe…

AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to authenticate as the administrator by using the publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty. Attackers can submit the default credentials to the authentication login endpoint to gain full c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-58455] Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows…

Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit() after an authentication redirect in loader.php combined with unsanitized input passed to shell_exec() in ajax/compose.php. Attackers can seed the required session flag through the incomplete auth check, then inject …

nvdcriticovulnerabilidad CVSS 9.8 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-55115] A malicious actor with access to the network and low privileges could exploit a Server-Side Request …

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-55116] A malicious actor with access to the network and under certain network configurations could exploit …

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

nvdcriticovulnerabilidad CVSS 9.0 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-54400] A malicious actor with access to the network and high privileges could exploit an Improper Access Co…

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.1 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-54402] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-50746] A malicious actor with access to the network could exploit an Improper Access Control vulnerability …

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 10.0 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-50747] A malicious actor with access to the network and low privileges could exploit a series of authentica…

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

U Crítico vulnerabilidad

02/07/2026

[CVE-2026-50748] A malicious actor with access to the network and low privileges could exploit an Improper Input Vali…

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57624] Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro

nvdcriticovulnerabilidad CVSS 10.0 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14405] Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute…

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD