Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 1 hora

[CVE-2026-78213] Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authen…

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad Nuevo

Hace 15 horas

[CVE-2026-8445] justhtml versions <= 1.11.0 (fixed in 1.12.0) do not sufficiently escape HTML-significant characters…

justhtml versions are preserved, so untrusted input that is safe in to_html() — including entity-decoded text (e.g. &lt;script&gt;) or t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-77115] Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into pop…

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad XSS Reflejado alta en Combodo iTop 3.2.2 y anteriores

Combodo iTop, herramienta de gestión de servicios IT ampliamente utilizada en empresas LATAM, contiene una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en el API de búsqueda de claves foráneas con puntuación CVSS 8.8. Un atacante puede inyectar código malicioso en parámetros de búsqueda para ejecutar scripts en navegadores de usuarios administrativos, comprometiendo credenciales y acceso a datos altas de infraestructura IT. La vulnerabilidad afecta versiones anteriores a 3.2.3.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta en OpenSearch Dashboards permite ejecución de código JavaScript arbitrario

Una validación deficiente en el plugin dashboards-observability de OpenSearch Dashboards permite a usuarios autenticados con permisos de escritura ejecutar código JavaScript malicioso en sesiones de otros usuarios mediante carga de activos comprometidos. Esta vulnerabilidad afecta directamente plataformas de observabilidad y análisis de logs ampliamente usadas en infraestructuras cloud de LATAM, exponiendo datos sensibles de infraestructura, bases de datos y aplicaciones altas.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-61824] Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt a…

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without the main pipeline's DOM-based sanitization. The affected paths include src/extractors/x-article.ts, src/extractors/substack.ts,…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-63135] YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS …

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-30890] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-31803] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected …

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-31880] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-30826] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-30865] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-30819] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-54682] DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with …

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.C…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-75933] Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and s…

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 3 días

Vulnerabilidad XSS almacenado alta en WPForms Pro para WordPress

El complemento WPForms Pro para WordPress es vulnerable a inyección de scripts almacenados en campos de texto simple y párrafo (versiones hasta 2.0.0.2) debido a sanitización insuficiente. Atacantes no autenticados pueden inyectar código malicioso que se ejecuta cuando usuarios acceden a páginas comprometidas. Este riesgo es alta para sitios comerciales, de servicios y gobierno en LATAM que dependen de formularios para captura de datos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-49436] LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API…

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint (`POST /api/v2/bulk/links`) accepts URLs without any format validation, allowing an authenticated user to store a `javascript:` URI. The stored URI is later rendered verbatim as an `href` in Blade templates, and clicking it executes arbitrary JavaScript in the victim's browser — exfiltrati…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-49825] lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attribute…

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 3 días

XSS no autenticado en NotificationX Pro versiones <= 3.1.4 (CVSS 7.1)

Se ha identificado una vulnerabilidad de Cross Site Scripting (XSS) no autenticado en NotificationX Pro hasta la versión 3.1.4, que permite a atacantes inyectar código malicioso sin credenciales. Esta falla afecta directamente a plataformas de comercio electrónico y sitios web en México y Latinoamérica que utilizan este plugin para notificaciones. El acceso no autorizado al código del cliente expone datos de usuarios y sesiones activas.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-66615] Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher

nvdaltovulnerabilidad CVSS 7.1 NVD