Alertas de Seguridad de la Información

M Crítico vulnerabilidad

03/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en Wavlink WL-NU516U1 (CVE-2026-18589)

Se identificó una vulnerabilidad de desbordamiento de búfer basado en pila en el router Wavlink WL-NU516U1 (versión 708c073-mt7628) que afecta la función de cambio de contraseña en nas.cgi. Un atacante remoto puede explotar esta falla manipulando el parámetro User1Passwd para ejecutar código arbitrario sin autenticación previa. El exploit es público y existe riesgo inmediato en infraestructuras de LATAM que utilizan este dispositivo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16300] The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, all…

The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16532] The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied…

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-16534] The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's…

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing administrator's password or email.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-15930] The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed dur…

The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-12965] The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthentica…

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/08/2026

Vulnerabilidad crítica de omisión de autenticación en WooCommerce Social Login

El plugin WooCommerce - Social Login para WordPress (versiones hasta 2.8.7) permite eludir la autenticación mediante el manejador de inicio de sesión de Apple, que acepta tokens sin validar la firma JWT ni verificar las claves públicas de Apple. Esta vulnerabilidad afecta directamente a tiendas en línea en México y LATAM que utilizan este plugin para gestionar accesos de clientes, exponiendo cuentas y datos de transacciones a acceso no autorizado.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en ArcadeDB anterior a 26.7.2 permite ejecución arbitraria de código JavaScript

ArcadeDB versiones anteriores a 26.7.2 no validan correctamente permisos de scripting en sentencias SQL DEFINE FUNCTION con lenguaje JavaScript, permitiendo que usuarios con acceso a la base de datos ejecuten código malicioso y eludir controles de seguridad. Este fallo afecta principalmente a empresas en LATAM que utilizan ArcadeDB para aplicaciones críticas sin actualizar regularmente. El CVSS 9.8 indica riesgo crítico que requiere atención inmediata.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica de bypass de autorización en ArcadeDB anterior a v26.7.2

ArcadeDB versiones anteriores a 26.7.2 contienen una vulnerabilidad de bypass de autorización en manejadores HTTP que afecta endpoints de series de tiempo, batch, Prometheus y Grafana. Los atacantes pueden acceder y modificar bases de datos sin permisos autorizados al invocar directamente estos endpoints con parámetros arbitrarios de base de datos. Esta falla impacta empresas en LATAM que usan ArcadeDB para almacenamiento de datos críticos o monitoreo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en GitPython 3.1.50 permite bypass de validación de opciones inseguras

GitPython 3.1.50 no reconoce correctamente opciones cortas concatenadas (como -u) al validar parámetros de clonación, permitiendo a atacantes eludir restricciones de seguridad mediante la opción --upload-pack/-u. Esta vulnerabilidad afecta aplicaciones que procesan opciones de clonación controladas por usuarios sin validación adicional, comprometiendo la integridad de repositorios Git en entornos empresariales.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica de inyección de comandos en flujos de trabajo de Wazuh (CVE-2026-67308)

Los flujos de trabajo de Wazuh anteriores a la versión 44bf114 contienen una vulnerabilidad de inyección de shell en GitHub Actions que permite a atacantes ejecutar comandos arbitrarios mediante pull requests manipulados con archivos VERSION.json especialmente crafteados. La explotación facilita la inyección de metacaracteres de shell en variables de entorno interpoladas directamente en pasos de ejecución, permitiendo robo de secretos como GITHUB_TOKEN y acceso no autorizado a sistemas CI/CD en organizaciones de LATAM que usen este software para orquestación de seguridad.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-68771] ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node tha…

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard_*.pkl file via the unauthenticated POST /upload/image endpoint and then queue a workflow graph via POST /prompt ref…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17351] The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assist…

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's defau…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17561] Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom…

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-14919] The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting tes…

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-reset email, to an address they control and take over the administrator account.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-14483] The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary Fi…

The Realtyna Organic IDX plugin + WPL Real Estate plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 5.2.0 via the upload function. This is due to missing file type validation in the upload function, combined with a publicly accessible I/O endpoint authenticated solely by static, plugin-seeded API credentials that are identical across all installation…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63223] CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload valid…

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads u…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-63221] CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch()…

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed i…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66421] OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated …

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66418] OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthent…

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C…

nvdcriticovulnerabilidad CVSS 9.3 NVD