Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-85531] Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment…

Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

Inyección SQL ciega en EduAdmin Booking permite acceso no autorizado a bases de datos

Una vulnerabilidad crítica de inyección SQL (CVE-2026-96809, CVSS 9.3) afecta EduAdmin Booking en versiones anteriores a 6.0.0, permitiendo a atacantes ejecutar consultas SQL maliciosas sin autenticación. Instituciones educativas, centros de capacitación y plataformas de reservas en México y Latinoamérica que utilicen este software están expuestas a exfiltración de datos sensibles y compromisos de bases de datos. La gravedad es crítica debido a la facilidad de explotación remota.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

Inyección SQL ciega en Ajax Search Pro afecta sitios WordPress en LATAM

Una vulnerabilidad crítica de inyección SQL (CVSS 9.3) en el plugin Ajax Search Pro para WordPress permite a atacantes ejecutar consultas SQL ciegas sin autenticación. Afecta versiones hasta 4.29.1 y representa riesgo severo para e-commerce, portales y sitios corporativos que usen este plugin en México y Latinoamérica, exponiendo datos de clientes y configuraciones de base de datos.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

Inyección SQL ciega crítica en plugin WPLMS afecta sitios WordPress en LATAM

Se identificó una vulnerabilidad de inyección SQL ciega (CVE-2026-96327, CVSS 9.3) en VibeThemes WPLMS versiones anteriores a 1.9.9.8.2. Un atacante puede manipular comandos SQL a través de parámetros no sanitizados, comprometiendo bases de datos de sitios educativos y empresariales. Dado que WPLMS es popular en plataformas e-learning de México y LATAM, la exposición es significativa.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-96328] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jegtheme JNews - Pay Writer jnews-pay-writer allows Blind SQL Injection.This issue affects JNews - Pay Writer: from n/a through 12.0.1.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

Inyección SQL ciega crítica en tagDiv Opt-In Builder versiones ≤1.7.6

Se ha identificado una vulnerabilidad de inyección SQL ciega (CVE-2026-96330, CVSS 9.3) en tagDiv Opt-In Builder que permite a atacantes ejecutar comandos SQL maliciosos sin validación adecuada de entrada. Esta falla afecta principalmente a sitios WordPress en México y Latinoamérica que utilizan este plugin para gestionar suscripciones y recopilación de datos. Un atacante podría extraer información sensible de bases de datos, comprometer credenciales o alterar registros críticos de clientes.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-94503] Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Uploa…

Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue affects Zombify: from n/a through 1.7.7.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-93947] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107935] A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-ta…

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107909] A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_…

A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only boun…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-107908] A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB b…

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then co…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-7826] A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/ser…

A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (src/serializers/serializer_io.c) in FalkorDB before 4.18.4 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or disclose heap memory by supplying a crafted RDB stream whose sub-buffer length field exceeds the re…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-5759] A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph …

A double free and use-after-free vulnerability in the RdbLoadDeletedNodes function of the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c) in FalkorDB before 4.18.1 allows a remote attacker who can issue Redis replication commands (for example, against an instance with no password configured) to cause a denial of service or execute arbitrary code in the redis-server process …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-94510] Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attack…

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-96207] Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to eleva…

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-88131] Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute …

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-77900] Missing authentication for critical function in Azure App Service allows an unauthorized attacker to…

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-69435] Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a …

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-84249] IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary man…

IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to execute arbitrary management operations due to missing authentication for critical function.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 1 día

[CVE-2026-75875] IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary…

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal.

nvdcriticovulnerabilidad CVSS 9.8 NVD