Alertas de Seguridad de la Información

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-43710] The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker may be able to cause unexpected system termination or corrupt kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-43682] The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-43694] The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination or write kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-39873] The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, …

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Connecting to a malicious SMB server may lead to unexpected system termination.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-28982] A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, m…

A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-28911] The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, m…

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to corrupt memory of a system process.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-28928] A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.…

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-55579] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, and terminal featur…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-48030] Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before versi…

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-17552] Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated …

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a reques…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-63077] In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible …

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-17191] An input validation vulnerability exists in an API component of the orchestrator. An authenticated u…

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not awa…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-66395] SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p…

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2025-50455] SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Al…

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59550] Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.

Unauthenticated SQL Injection in AWP Classifieds

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59538] Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Unauthenticated SQL Injection in GamiPress

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59549] Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.

Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59527] Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.

Unauthenticated SQL Injection in MapSVG

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-59533] Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

Unauthenticated SQL Injection in Relevanssi Light

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-65879] Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret …

Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms.

nvdcriticovulnerabilidad CVSS 9.8 NVD