Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2024-58376] Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 m…

Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject commands executed during helm repo add operations, gaining full access to Renovate's execution environm…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-76235] A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every …

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-73388] Unauthenticated SQL Injection in Nikstore Core <= 1.5 versions.

Unauthenticated SQL Injection in Nikstore Core

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66668] Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.

Subscriber SQL Injection in Community by PeepSo

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad alta en kernel: corrupción de memoria en operaciones de fork (CVE-2026-58083)

Una vulnerabilidad de race condition en el kernel permite que knotes con filtros basados en timer se colen en la lista activa de kqueue durante operaciones de fork, corrompiendo estructuras de memoria altas. Con CVSS 8.4, afecta la estabilidad y seguridad de servidores Unix/BSD en entornos empresariales de LATAM. La falta de sincronización de locks durante la copia de knotes habilita explotación local con privilegios elevados.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad alta en semctl(2) permite acceso no autorizado a semáforos del sistema

Una falla en los comandos GETALL y SETALL de semctl(2) permite que atacantes locales manipulen semáforos del kernel entre ciclos de creación/destrucción, explotando un desbordamiento de secuencia tras 0x8000 operaciones. Afecta sistemas Unix/Linux en producción que ejecutan aplicaciones multi-proceso con semáforos del sistema operativo, comprometiendo la integridad de sincronización en bases de datos y middleware alta.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad alta en código de volcado de núcleo ELF permite escritura de memoria fuera de límites

Una vulnerabilidad en el procesamiento de volcados de núcleo ELF (CVE-2026-58088, CVSS 7.4) permite que procesos no privilegiados que compartan espacio de direcciones mediante rfork(2) causen desbordamientos de búfer al mutar mapas de memoria entre dos pasadas de iteración. Afecta principalmente a sistemas Unix/Linux en servidores y estaciones de trabajo en LATAM donde se ejecutan aplicaciones con multiprocessing.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad XSS almacenado en plugin TranslatePress para WordPress hasta v3.2.5

El plugin TranslatePress para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado sin autenticación requerida en versiones hasta 3.2.5. Los marcadores especiales '#!trpst#' y '#!trpen#' se reescriben incondicionalmente a caracteres HTML, permitiendo inyección de código malicioso. Afecta principalmente a sitios multilingües en LATAM que utilizan este plugin para traducción de contenidos.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad XSS en WP Statistics afecta sitios WordPress hasta versión 14.16.8

El plugin WP Statistics para WordPress contiene una vulnerabilidad de Cross-Site Scripting (XSS) almacenado en el parámetro 'utm_campaign' que permite a atacantes no autenticados inyectar scripts maliciosos. La falla afecta todas las versiones hasta 14.16.8 y se ejecuta cuando visitantes acceden a páginas comprometidas, poniendo en riesgo datos de usuarios y credenciales en sitios empresariales, de comercio electrónico y portales informativos comunes en LATAM.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-19842] The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML respo…

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-19055] The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parame…

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-19056] The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter be…

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted request.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-18776] The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of i…

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-18031] The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before est…

The TabaPay Gateway WordPress plugin through 1.4.0 does not validate the payment callback before establishing a session for the account associated with the referenced order, allowing unauthenticated attackers to log in as any registered user, including an administrator.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-17565] The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied …

The Animation Addons for Elementor WordPress plugin before 2.7.2 does not validate a user-supplied value before using it to build the host of a server-side HTTP request, allowing unauthenticated users to make the site issue requests to internal hosts and read the responses back.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-16617] The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's …

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users (when front-end file management is enabled) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the list.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-16950] The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a paramet…

The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-14861] The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request …

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-16570] The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of t…

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are tricked into opening a crafted link.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-14334] The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly s…

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and executes arbitrary JavaScript when the SVG is opened, including in the session of an administrator who…

nvdaltovulnerabilidad CVSS 8.8 NVD