Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/07/2026

[CVE-2026-9282] The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, …

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-4661] The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to…

The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'fildname' parameter in all versions up to, and including, 2.2.2. This is due to insufficient escaping of user-supplied column names in the ajaxCheck() method and lack of preparation in the $wpdb->update() call. The vulnerability is compounded by the complete …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13756] The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator b…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-14480] OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web U…

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-49213] TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/…

TypeBot is a chatbot builder tool. Prior to 3.17.2, Typebot's shared SSRF validator in packages/lib/src/ssrf/validateHttpReqUrl.ts can be bypassed with the IPv6 unspecified address :: because validateIPAddress blocks local, metadata, and private ranges but does not block :: or its expanded form. A workspace editor or creator can configure a server-side HTTP Request block or guarded script fetch to…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-55879] OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking…

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated dashboard through TextEllipsis and the event-details modal, allowing an unauthenticated attacker to store…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55880] OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mu…

OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predicate that their sibling read and edit functions use: notes.delete filtered only on note id and project id, while dashboards.update_widget and dashboards.remove_widget filtered only on dashboard id and widget id, allowing any authenticated mem…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55405] LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta…

LangChain4j is a Java library for building LLM-powered applications on the JVM. Prior to 1.2.1-beta8, 1.5.1-beta11, 1.11.8-beta19, and 1.16.3-beta26, the MariaDB and pgvector embedding stores build metadata-filter SQL by string-concatenating filter keys, and in MariaDB string values, directly into the query without adequate escaping. A crafted metadata key in EmbeddingSearchRequest.filter() can b…

nvdaltovulnerabilidad CVSS 7.6 NVD

F Crítico vulnerabilidad

10/07/2026

[CVE-2026-57156] FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, F…

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients contain an integer overflow in update_read_delta_points in libfreerdp/core/orders.c when multiplying an attacker-controlled point count by sizeof(DELTA_POINT), allowing a malicious RDP peer to allocate an undersized heap buffer and then write beyond it during initialization. This issu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55789] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into element-text placeholders of a SAML XML template using samlify 2.10.0, which left those placeholders u…

nvdaltovulnerabilidad CVSS 8.5 NVD

Y Alto vulnerabilidad

10/07/2026

[CVE-2026-54919] cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed T…

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In affected Mbed TLS backend versions from 0.31.0 through 0.46.1 and wolfSSL backend versions from 0.33.0 through 0.46.1, when cpp-httplib is built with CPPHTTPLIB_MBEDTLS_SUPPORT or CPPHTTPLIB_WOLFSSL_SUPPORT and a client connects to an IP-literal host with server certificate verification enabled, SSLClient and Clie…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-1667] The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Sto…

The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to create arbitrary posts, and, if the Advanced Custom Fields plugin is installed and acti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-55500] 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f…

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61434] PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command executio…

PraisonAI versions before 4.6.78 contain an allowlist bypass vulnerability in shell command execution that allows attackers to execute restricted commands via find's built-in -exec, -execdir, and -delete actions. Attackers can craft find commands with these built-in actions to read blocked files, delete files, or execute non-allowlisted binaries without triggering shell metacharacter filters.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56279] Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RP…

Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56305] Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoin…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. Attackers with temporary session access can exploit this flaw to permanently lock out legitimate users and achieve full account takeover.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-22660] FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows auth…

FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a type mismatch in the bulk delete protection check. The bulk AJAX endpoint in the management views compares received JSON integer group IDs against string literals, causing the protection check to always pass, which …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-12685] The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscat…

The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key permanently delete all of the site's content, and that covertly transmits the site URL, administrator email address, and license key to a third-party server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15330] A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_ima…

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function _build_image_content/_download_to_data_url of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15288] The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Impro…

The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data in the 'create_payment_intent' and 'create_subscription_intent' functions without validating it against the form's configured price. This m…

nvdaltovulnerabilidad CVSS 7.5 NVD