Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73291] Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to v…

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route, allowing a malicious or compromised Jellyfin or Emby server, or a man-in-the-middle attacker…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16051] The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages inst…

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66147] An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G…

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66149] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur…

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via netmask.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-66150] Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Secur…

Improper Control of Generation of Code ('Code Injection') Vulnerability in the SonicWall Email Security appliance allows an authenticated attacker with access to the SonicWall Email Security restricted CLI can inject arbitrary OS commands that execute as root via SNMP.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73032] PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e…

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66145] An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044)…

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-45618] LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi…

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-70336] Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthoriz…

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-70338] Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthor…

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-19546] A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.…

A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-58231] SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and s…

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-44758] SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to subm…

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-66738] SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navig…

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET reque…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en OpenYak permite ejecución de código remoto desde navegadores web

OpenYak, un runtime local para modelos de IA con herramientas integradas, presenta una vulnerabilidad crítica (CVSS 9.6) en versiones anteriores a 1.1.3. El backend del escritorio expone una API HTTP sin validación de origen, autenticación de loopback ni enforcement de Content-Type, con política CORS abierta. Cualquier página web visitada mientras OpenYak se ejecuta puede ejecutar comandos arbitrarios en el sistema local, comprometiendo completamente la máquina del usuario.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-48054] OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of component…

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. N…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-66709] Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

Shop manager Remote Code Execution (RCE) in CTX Feed

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65553] Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 …

Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-65548] Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

Contributor Remote Code Execution (RCE) in Betheme

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71319] Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (developm…

Nuxt is an open-source web development framework for Vue.js. Prior to 3.3.1, Nuxt DevTools (development mode only) exposes a bidirectional RPC channel over the Vite HMR WebSocket via the nuxt:devtools:rpc plugin. On affected versions the channel has no authentication: any client that can reach the Vite HMR endpoint (ws://:/, subprotocol vite-hmr) can call RPC methods, with no token, ha…

nvdcriticovulnerabilidad CVSS 9.6 NVD