Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-48836] Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

Unauthenticated Remote Code Execution (RCE) in Easy Invoice

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-39465] Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50880] An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to e…

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50871] An OS command injection vulnerability in the media archiving and export pipeline component of kanish…

An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50872] An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attacker…

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

R Crítico vulnerabilidad

15/06/2026

[CVE-2026-30120] remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability…

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-52704] Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce P…

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

nvdcriticovulnerabilidad CVSS 10.0 NVD

J Crítico vulnerabilidad

12/06/2026

[CVE-2026-54133] jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elem…

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON document, in PHP applications with PHP data structures. Versions prior to 2.9.1 can generate and execute attacker-controlled PHP code when `JmesPath\CompilerRuntime` is used with an attacker-controlled JMESPath expression. The compiler emits parsed JMESPath function names into gener…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2017-20251] WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that al…

WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the ser…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-52778] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability e…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11393] Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI be…

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collab…

nvdcriticovulnerabilidad CVSS 9.0 NVD

F Crítico vulnerabilidad

08/06/2026

[CVE-2026-46442] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When E2B_APIKEY is not configured — the common deployment case — Flowise executes this code inside a NodeVM sandbo…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/06/2026

[CVE-2026-47117] OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model …

OpenMed before 1.5.2 contains a remote code execution vulnerability in the PII privacy-filter model loading path. The privacy-filter dispatcher used broad substring matching on the user-supplied model_name parameter, allowing a value such as attacker/foo-privacy-filter-bar to route through a path that loads Hugging Face models with trust_remote_code=True. An unauthenticated attacker can supply a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD