Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71232] MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP fu…

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71233] InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Larave…

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from the field and does not purify HTML. An authenticated user with invoice creation access can set the t…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-12609] In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend expo…

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-25703] NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to m…

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-44945] A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests…

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-10090] A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of…

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource pointing to a Helm repository they control and a Subscription resource referencing it. The app-subscription controller fetches and applies t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-10059] A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant admin…

A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant administrator the ability to mint a token for a ServiceAccount with cluster-wide administrative authority. This leads to a privilege escalatio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7444] The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all …

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7520] The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of …

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` and `sign_up()` AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to relink the site's MailMunch integration to an attacker-controlled MailMu…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7693] The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up t…

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_resto…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71209] audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-all…

audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. Express's router decodes the :id route parameter before handler code runs, so a %2F-encoded '../' sequence in :id (e.g. ..%2f..%2f..%2ftmp%…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71211] MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/ser…

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full re…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71213] Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, fa…

Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login()) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-guessing requests against any account, including administrators, with no throttling. The only attempt-counting/lockout logic present in the …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71214] The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derive…

The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app.ts) derives the caller's Hasura session role via getHasuraSession(), which prefers a session_variables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims, with no verification that the request actually originated from Hasura. By setting {"session_variab…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71215] art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both…

art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include() and extend() template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. Because path.resolve() discards root entirely when filename is an absolute path, and does not block '../' traversal sequences, …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71202] The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source …

The raster Rust crate's crop() function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, `width2 - offset_x` (or the height equivalent) underflows to a negative i32, which release builds do not trap; the negative value i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71206] Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and …

Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. Deleting an account or demoting it from owner to a regular role has no effect on tokens already issued to that account — a de…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-71207] The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password v…

The Stock-Inventory-Management-System application's login.php assigns raw $_POST username/password values to $_SESSION and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. An unauthenticated remote attacker can submit a payload such as ' OR '1'='1 in the login form to bypass authentication entirely. The same s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-6147] The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t…

The LightSync Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the rest_replace_media() function in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-6627] The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unautho…

The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentials in all versions up to, and including, 1.1.1. This is due to missing capability checks and nonce verification on the `wpf_stripe_callback_success()` and `wpf_stripe_disconnect()` functions, both hooked to `admin_init`. The `admin_init` hoo…

nvdaltovulnerabilidad CVSS 8.2 NVD