Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15490] A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce…

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk/kd_cs results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product impleme…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15488] A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileCon…

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of the file app/common/controller/FileController.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.4 is able to address this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15489] A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a…

A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. This product follows a rolling release…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15484] A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function su…

A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file /goform/tools_nslookup of the component ssi. The manipulation results in buffer overflow. It is possible to launch the attack remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.0R) as these items have been EOL. …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15482] A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown proces…

A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consultar of the component HTTP Handler. Executing a manipulation of the argument nome/perfil/status can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15483] A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function …

A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the file /goform/tools_nslookup of the component ssi. The manipulation of the argument nslookup_target leads to buffer overflow. It is possible to initiate the attack remotely. The vendor explains: "We are unable to confirm the existence of the vulnerabilities for (...) TEW-821DAP (v1.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15480] A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start…

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument device_name leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor explains: "We are unable to confirm if the vulnerability …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15481] A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects…

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_ipaddr results in command injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15479] A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function chang…

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early ab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

11/07/2026

[CVE-2026-61445] PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the A…

PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-61429] PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI…

PraisonAI versions before 1.6.78 contain a server-side request forgery vulnerability in the Crawl4AI/Chromium backend that allows attackers to bypass SSRF validation by exploiting DNS rebinding and HTTP redirects. Attackers can craft URLs that resolve to internal services after the initial validation check, enabling the headless browser to follow redirects and read internal responses including sen…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-61439] PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block…

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financial manipulation that trigger HIGH severity detection but are logged without blocking, enabling system p…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-9282] The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-6939] The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Sc…

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approval_code' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-7655] The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in vers…

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13378] The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site …

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13114] The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Store…

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a u…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13756] The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-42952] Previously, there was no throttling on repeated authentication attempts to the charging station bac…

Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

10/07/2026

[CVE-2026-55175] Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2…

Spinnaker is an open source, multi-cloud continuous delivery platform. Prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 on their respective release lines, Kustomize bake operations allow unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes. This issue is fixed in versions 2026.1.1, 2026.0.3, 2025.4.4, and 20…

nvdaltovulnerabilidad CVSS 7.5 NVD