Alertas de Seguridad de la Información

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28306] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28307] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user grou…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28308] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28309] SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administ…

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28310] SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administr…

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

S Crítico vulnerabilidad

21/07/2026

[CVE-2026-28302] SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can l…

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65052] Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerab…

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, cau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-8933] A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component…

A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or secur…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65048] Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored c…

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65049] Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorizat…

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_a…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-15226] A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution e…

A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment compiler (snap-confine). The default seccomp security templates generated by the engine to restrict system calls do not filter or reject process operations capable of creating or manipulating file execution flags with set-user-ID attributes. Consequently, an application running within a …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16447] A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file …

A vulnerability has been found in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /web/jquery/uploader/multi_uploadify.php. The manipulation of the argument Filedata[] leads to unrestricted upload. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16445] A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability…

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to comman…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16384] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16385] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16386] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-16376] Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and…

Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-1617] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-1771] The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type val…

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-8082] The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter bef…

The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPress plugin before 3.2.3.

nvdaltovulnerabilidad CVSS 7.5 NVD