Alertas de Seguridad de la Información

M Crítico vulnerabilidad

09/06/2026

[CVE-2025-10263] Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Co…

Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2009-10007] Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixatio…

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id cookie can use this to impersonate the victim.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-40128] SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a …

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-44748] SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal…

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on conf…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-27671] Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP…

Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory corruption. This could lead to a high impact on the confidentiality, integrity, and availability of the application.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-52778] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability e…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11393] Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI be…

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collab…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-39910] STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low…

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-41448] AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability t…

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware. Attackers can craft a request with a traversal payload in…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-25555] OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key aut…

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied header against an empty AdminApiKey default string to access the admin console and all API endpoints witho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11499] A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function…

A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2023-54352] WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attack…

WordPress Seotheme contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php to execute system commands and upload additional files for persistent access.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2024-58348] WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that a…

WordPress Background Image Cropper version 1.2 contains a remote code execution vulnerability that allows unauthenticated attackers to upload arbitrary files by accessing the ups.php endpoint. Attackers can upload PHP files through the file upload form in the plugin directory to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2024-58349] WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauth…

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by exploiting insufficient validation in the theme's upload functionality. Attackers can upload arbitrary files to the theme directory and execute them to achieve remote code execution on the affected WordPress installation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-10580] The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass le…

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_acce…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-36500] An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to e…

An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71317] NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants…

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrat…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2025-71318] NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remo…

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — includin…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-49777] Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider…

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-6274] Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerabi…

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD