Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73050] SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select op…

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

15/08/2026

[CVE-2026-73041] SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the se…

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-70306] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Of…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-9195] A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6…

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perform privileged actions on the administrator's behalf.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66421] OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated …

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66418] OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent…

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-11707] IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affecte…

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-66395] SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p…

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65605] SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (databas…

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as are skipped by that check, a payload like is stored un…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-65606] SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler…

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an element. Because…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65048] Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c…

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-39878] Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the …

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been patched in 1.11.40.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-35198] HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting (XSS) vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through privilege escalation. Version 3.0.0-rc.7 contains a patch for the issue.

nvdcriticovulnerabilidad CVSS 9.0 NVD

I Crítico vulnerabilidad

17/07/2026

[CVE-2026-15091] IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary sc…

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-54458] WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site…

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a sign…

nvdcriticovulnerabilidad CVSS 9.6 NVD

O Crítico vulnerabilidad

15/07/2026

[CVE-2026-62948] OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DH…

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-62378] RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until …

RustFS Console is a web management console for the RustFS distributed file system. From 0.1.7 until 0.1.10, the RustFS Console components/object/preview-modal.tsx and components/object/pdf-viewer.tsx extension-based PDF preview path can render HTML content uploaded as .pdf, allowing stored cross-site scripting in the management console and exposure of administrator AccessKeyId, SecretAccessKey, an…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-47428] Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Brow…

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. This issue is fixed in ve…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-55008] Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex…

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-11913] vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *.*.

nvdcriticovulnerabilidad CVSS 9.8 NVD