Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72899] Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or da…

Metabase allows an unauthenticated attacker to inject arbitrary SQL via a publicly shared card or dashboard that exposes a field-filter (dimension) parameter.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72736] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a safe local code path (using execFileAsync or the Docker API) but a vulnerable remote path (using execAs…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72737] Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create,…

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced destination without verifying that destination.organizationId equals ctx.session.activeOrganizationId. An authenticated member with backup per…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72738] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBack…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.listBackupFiles tRPC endpoint in apps/dokploy/server/api/routers/backup.ts passes the search parameter through normalizeS3Path and interpolates it into an rclone lsjson command executed by child_process.exec(), allowing an authenticated user with backup:read permission to execute arbitrary commands on the D…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72740] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, packages/server/src/utils/providers/git.ts parses the user-controlled customGitUrl with sanitizeRepoPathSSH and interpolates its domain into the ssh-keyscan command from addHostToKnownHostsCommand without shell quoting, allowing an authenticated member with service deployment permission and an attached SSH key to exec…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72733] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreB…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while pa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72734] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/server.ts accepts a caller-controlled serverId and calls haveActiveServices, findServerById, removeDeploymentsByServerId, and deleteServer without verifying that currentServer.organizationId equals ctx.session.activeOrganizationId. An authenti…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72735] Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigR…

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, writeTraefikConfigRemote in packages/server/src/utils/traefik/application.ts serializes user-controlled Traefik configuration with yaml.stringify and interpolates the resulting yamlStr into an echo command executed through execAsyncRemote. Single quotes in redirect regex and replacement fields, basic authentication us…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72730] Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0…

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72731] Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026…

Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a group a query is shared with, could craft parameter values that escaped the intended query and executed arbitrary SQL through plugins/discourse-data-explorer/lib/discourse_data_explo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-71576] A flaw was found in multicluster-global-hub. The manager component improperly validates the source i…

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the attacker to falsify or delete critical data, such as compliance, inventory, and cl…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-66738] SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navig…

SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET reque…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-47754] Metacat is data repository software that helps researchers preserve, share, and discover data. Versi…

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is part of the original 1.x Metacat API. `ArchiveHandler.readArchiveEntry()` concatenates the user-supplied parameter into a filesystem path wi…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-48048] XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm w…

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-63106] ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product l…

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72689] A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allo…

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72690] An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated …

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question c…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72691] An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unaut…

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72692] A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauth…

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, ena…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-6374] Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constant…

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

nvdaltovulnerabilidad CVSS 7.3 NVD