Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101008] A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file o…

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted ear…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101002] A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function …

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early …

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101000] A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.…

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted ear…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101001] A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval…

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about thi…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-100896] A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the funct…

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-100886] A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. …

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of the component Debug Service. Such manipulation leads to improper authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-101065] Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, th…

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the README starts the container listening on 0.0.0.0:8080 with authentication disabled by default. When authentication is disabled, every request is mapped to a synthetic "nobody" user that holds the Owner and Admin roles, so any unauthenticated party who ca…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-101084] obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allo…

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipulate sensitive backend systems through MCP tool calls using stored OAuth credentials.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

27/09/2026

Inyección Eval crítica en hMailServer 6.0.0-6.3.3 permite ejecución remota de código

Una vulnerabilidad crítica (CVSS 9.8) en el despachador de scripts JScript de hMailServer permite a atacantes no autenticados ejecutar código arbitrario con privilegios de servicio. La falla se activa mediante contraseñas manipuladas con secuencias de escape en autenticación SMTP, POP3 e IMAP. Afecta principalmente a servidores de correo en Windows en organizaciones de México y LATAM que usen versiones 6.0.0 a 6.3.3.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/09/2026

[CVE-2026-100740] A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_param…

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-85984] The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to A…

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as suffici…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100716] Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (…

Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate intermediate path components of the export destination: Froxlor\FileDir::makeCorrectDir() contains an off-by-one in its path-component walk that skips the first segment below the customer home directory, and the guard in ExportCron.php checks only the final component…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/09/2026

[CVE-2026-100717] froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl reje…

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parse_url, and never inspects the userinfo (user:pass@) components. This is an incomplete fix for GHSA-c3p2. An authenticated low-privilege customer with subdomain-create rights (no admin or chan…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

26/09/2026

Vulnerabilidad crítica de carga arbitraria de archivos en plugin Request a Quote for WooCommerce

El plugin Request a Quote for WooCommerce para WordPress es vulnerable a carga arbitraria de archivos en versiones hasta la 2.9.2 debido a validación insuficiente de extensiones y tipos MIME en la función afrfq_submit_quote_via_popup(). Un atacante puede cargar archivos maliciosos (como shells PHP) directamente al servidor sin restricción, comprometiendo completamente sitios de comercio electrónico en LATAM. Con CVSS 9.8, afecta principalmente a pequeñas y medianas empresas que usan este plugin para gestionar cotizaciones de productos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-39353] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file placed in the directory is automatically trusted by Mdl_templates and can be selected as publi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-42322] Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/…

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the stored filename. An authenticated administrator can upload image content with a server-executable final extension, causing the file to be placed…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

Vulnerabilidad crítica en plugin Bookly para WordPress permite acceso no autorizado a datos de reservas

El plugin Bookly para WordPress (versiones hasta 28.2) contiene una vulnerabilidad de Referencia Directa a Objetos (IDOR) en acciones AJAX que permite a atacantes acceder y manipular datos de reservas, sesiones y órdenes sin autenticación. Afecta directamente a negocios de servicios en LATAM que usan este plugin para gestionar citas y pagos online, exponiendo información de clientes y transacciones.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-89055] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in a…

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-14281] The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin fo…

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/` and the absence of a key allowlist in the `finish_registration_logic` function, which…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/09/2026

[CVE-2026-95699] Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users acce…

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

nvdcriticovulnerabilidad CVSS 9.6 NVD