Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55659] Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-…

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's name or description, set by a document editor, is rendered into the page that other users load when openin…

nvdaltovulnerabilidad CVSS 7.7 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55466] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG c…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, UploadFileRequest sanitizes SVG content only when PHP finfo reports image/svg+xml and UploadedFilesController serves attachments inline without using StorageHelper::allowSafeInline(), allowing a low-privilege user to upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer’s browser. T…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-56667] ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and S…

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a javascript or data URI that can execute in a user's browser when an affected login error path is reach…

nvdaltovulnerabilidad CVSS 7.3 NVD

J Alto vulnerabilidad

10/07/2026

[CVE-2026-59794] In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-re…

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

nvdaltovulnerabilidad CVSS 7.3 NVD

J Alto vulnerabilidad

10/07/2026

[CVE-2026-59795] In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-29519] Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflect…

Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding HTML or JavaScript payloads within the request path. Attackers can craft a malicious URL containing injected script content that i…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15298] The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions u…

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to, and including, 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles. This makes it possible for unauthenticated attackers to inject malicious scripts via Telegram chat titles that execute when an administrator…

nvdaltovulnerabilidad CVSS 7.2 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-53963] Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5…

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59214] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and ex…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-9253] The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Sto…

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesse…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-13441] The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored …

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter in all versions up to, and including, 4.3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-2342] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Stored XSS. This issue affects ValeApp: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15000] The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scr…

The Connect Contact Form 7 and Mailchimp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values in all versions up to, and including, 0.9.78.06 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected pag…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-47646] Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365…

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

nvdcriticovulnerabilidad CVSS 9.3 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-6896] GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55596] Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed rendere…

Plate is a rich-text editor with AI and shadcn/ui. From 53.0.0 until 53.1.4, the media embed renderer trusts serialized provider or sourceUrl metadata in useMediaState and skips parseMediaUrl protocol validation, allowing a crafted Plate document to set a known video provider while keeping url as a javascript: iframe source that the registry MediaEmbedElement renders directly as an iframe src when…

nvdaltovulnerabilidad CVSS 8.7 NVD

J Crítico vulnerabilidad

08/07/2026

[CVE-2026-54527] JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts …

JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenames directly to innerHTML when rendering renamed files in commit history, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab. This issue is fixed in version 0.54.0.

nvdcriticovulnerabilidad CVSS 9.0 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-13320] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 7.3 NVD

P Alto vulnerabilidad

08/07/2026

[CVE-2026-11903] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue affects MOVEit Transfer: from 2026.0.0 before 2026.0.1, from 2025.1.0 before 2025.1.4, from 2025.0.0 before 2025.0.8.

nvdaltovulnerabilidad CVSS 8.0 NVD

D Alto vulnerabilidad

08/07/2026

[CVE-2026-41122] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disc…

nvdaltovulnerabilidad CVSS 7.1 NVD