Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 5 horas

[CVE-2026-107809] Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired acce…

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenti…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad Nuevo

Hace 7 horas

[CVE-2026-62026] Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allo…

Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue affects Dashboard Notes: from n/a through 1.0.3.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad Nuevo

Hace 11 horas

Vulnerabilidad CSRF alta en Featured Image from URL (fifu.app) versiones hasta 6.0.7

Se detectó una vulnerabilidad de Falsificación de Solicitud Entre Sitios (CSRF) en el plugin Featured Image from URL para WordPress que permite a atacantes ejecutar acciones no autorizadas en sitios afectados. La vulnerabilidad impacta versiones desde la inicial hasta la 6.0.7, afectando miles de sitios WordPress en LATAM que utilizan este plugin para gestión de imágenes destacadas. Con CVSS 8.8, representa un riesgo alta para la integridad y disponibilidad de contenido.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107337] The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authenti…

The Malcolm kiosk Flask application exposes a POST /script_call/ endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107295] Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. …

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools wi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-62142] Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request…

Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from n/a through 4.1.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-66479] Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allo…

Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPComplete: from n/a through 2.9.5.6.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-106611] Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site …

Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105783] Joplin is an open source note-taking and to-do application that organises notes and lists into noteb…

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: * and allows an arbitrary website to call POST /auth and GET /auth/check because the pairing endpoints do not reject HTTP o…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 4 días

Vulnerabilidad CSRF alta en Blubrry PowerPress Podcasting hasta versión 11.17.9

Se ha identificado una vulnerabilidad de Falsificación de Solicitud Entre Sitios (CSRF) en el plugin Blubrry PowerPress Podcasting para WordPress que afecta versiones hasta 11.17.9. Esta falla permite a atacantes ejecutar acciones no autorizadas en plataformas de podcasting, incluyendo modificación de contenido y configuraciones administrativas. Es especialmente alta para medios, productoras de contenido y plataformas de distribución de audio en LATAM que utilizan este plugin.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-39718] Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site R…

Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad CSRF alta en YesWiki anterior a 4.6.7 permite eliminación de páginas

YesWiki versiones anteriores a 4.6.7 contienen una vulnerabilidad de falsificación de solicitud entre sitios (CSRF) en el manejador ajaxdeletepage que permite a atacantes eliminar permanentemente páginas y su contenido asociado (ACLs, enlaces, comentarios) mediante solicitudes GET manipuladas sin validación de tokens. Un administrador o propietario de página autenticado puede ser engañado a hacer clic en un enlace malicioso, resultando en pérdida irreversible de datos altas en sistemas wiki empresariales.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104447] YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAct…

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-56660] GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts its contents into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to b…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-56662] GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of…

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the UpdateCE update form contained no anti-CSRF token, and the POST handler performed no token or request-origin verification. A remote attacker can host a page that auto-submits a forged POST to the update endpoint; when an authenticated administrator visits it, the…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-104059] Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blue…

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions by sending cross-origin requests without CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can exploit the newattachment, deleterecord, build, clean, and publish endpoints from a m…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103067] Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful…

Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-101147] The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Pre…

The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which could allow attackers to make a logged-in administrator perform any REST API action, such as creating a new administrator account, via a CSRF at…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-96838] Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Frau…

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82380] Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-…

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a value the server itself generated for the request. No optional feature or non-default configuration …

nvdaltovulnerabilidad CVSS 8.1 NVD