Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-24067] Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.p…

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subje…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3018] The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscrib…

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2025-6254] The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, …

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-3326] The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before usi…

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-8071] The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize …

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a custom shortcode used in its email-encoding feature, allowing unauthenticated attackers to inject arbitrary web scripts into approved comments that will execute when any user (including administrators) views the post.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-9067] The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilit…

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos…

nvdcriticovulnerabilidad CVSS 9.1 NVD

N Alto vulnerabilidad

10/06/2026

[CVE-2026-10846] NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolv…

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks matching the query destination address and port with the response source address and port. Furthermore not the query ID, neither the question of the query is matched with that of the response. This makes applications, that use ldns for (stub) resolver functionality over UDP, vulne…

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2026-26241] A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can…

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-11837] A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The…

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator ru…

nvdaltovulnerabilidad CVSS 7.3 NVD

Q Crítico vulnerabilidad

10/06/2026

[CVE-2026-26240] A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can…

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdcriticovulnerabilidad CVSS 9.1 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26239] A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gai…

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5208 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26237] A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can …

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24719] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24724] An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote att…

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass intended access restrictions. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5243 and later

nvdaltovulnerabilidad CVSS 8.1 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-24716] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66281] A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system v…

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.3500 build 20260520…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-22893] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66273] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66279] A command injection vulnerability has been reported to affect several QNAP operating system versions…

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and later QuTS hero h5.3.4.35…

nvdaltovulnerabilidad CVSS 7.2 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2025-66280] An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating s…

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3410 build 20260214 and later QuTS hero h5.2.9.3410 build 20260214 and …

nvdaltovulnerabilidad CVSS 7.2 NVD