Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-62674] Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prio…

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/session…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

Hace 2 días

[CVE-2026-77806] SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited i…

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyse_resultat_skel.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

Ejecución remota de código en SPIP anterior a 4.4.20 (CVE-2026-77647)

SPIP versiones anteriores a 4.4.20 contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes no autenticados ejecutar código arbitrario de forma remota, explotada activamente desde agosto de 2026. La falla radica en la identificación incorrecta de bloques PHP y el manejo deficiente de caracteres especiales por var_export. Afecta directamente a instituciones, medios digitales y PyMEs que usan SPIP como gestor de contenidos en la región.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

Ejecución remota de código crítica en Query Wrangler hasta versión 1.5.57 (CVE-2026-73992)

Se ha identificado una vulnerabilidad crítica de ejecución remota de código (RCE) en Query Wrangler versiones 1.5.57 e inferiores, con puntuación CVSS de 9.9. Los atacantes pueden ejecutar código arbitrario en sistemas que usen versiones vulnerables, comprometiendo bases de datos y aplicaciones dependientes. Esta vulnerabilidad afecta directamente a infraestructuras de procesamiento de consultas en empresas de telecomunicaciones, finanzas y servicios en la región.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-72530] A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions…

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-53451] Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO command passes attacker-controlled snapshotName input from backend/handlers/entities/sdr.py to backend/server/snapshots.py, where os.path.join permits an absolute path or parent-directory traversal an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-18937] The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accep…

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic (non-block) is active.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-45117] MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not…

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-73343] Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-32444] Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Contributor Remote Code Execution (RCE) in Cwicly

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-19478] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-73678] MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution …

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73649] Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, t…

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-61962] Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.

Unauthenticated Arbitrary Code Execution in WP BASE Booking

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-27544] Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

Unauthenticated Remote Code Execution (RCE) in QA Analytics

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73268] A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant …

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does not validate user-controlled input when unmarshaling the spec.install.overrideJob raw extension. Successful exploitation allows the injected…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73299] Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the T…

Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16051] The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages inst…

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66147] An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G…

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73032] PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e…

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero…

nvdcriticovulnerabilidad CVSS 9.6 NVD