Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/07/2026

[CVE-2026-13353] The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress i…

The WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.0.1 via the 'MappedFields' parameter. This is due to missing capability checks on the AJAX handlers for install_addon, saveMappedFields, and StartImport, combined with the plugin nonce being exposed to any authenticated us…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-61444] PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the a…

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the generated server code runs via subprocess.Popen().

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-54769] Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.…

Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution (RCE) in its `TableChatAgent` and `VectorStore` capabilities. When these agents evaluate LLM-generated tool messages with `full_eval=True`, they attempt to sandbox the execution by explicitly setting `locals` to an emp…

nvdcriticovulnerabilidad CVSS 10.0 NVD

V Alto vulnerabilidad

09/07/2026

[CVE-2026-59856] Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script i…

Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search() pattern that is run via win_execute() without escaping. A name containing a single quote can terminate the search() string argument early, and because the bar is honor…

nvdaltovulnerabilidad CVSS 7.8 NVD

V Alto vulnerabilidad

09/07/2026

[CVE-2026-59858] Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in …

Vim is an open source, command line text editor. Prior to 9.2.0735, the C omni-completion script in runtime/autoload/ccomplete.vim interpolates the typeref: or typename: extension field of a tags entry, without escaping, into a :vimgrep pattern that is run through :execute. Because :vimgrep honors the bar as a command separator, a crafted tag field can close the search pattern and append an arbitr…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

09/07/2026

[CVE-2026-59826] Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58…

Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties on one database-creation code path, allowing an authenticated administrator to register a crafted H2 database connection and execute arbitrary Java code on the Metabase server. This issue is fixed in vers…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59216] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was connected, allowing authenticated users who learned another socket ID through ydoc:document:join to run code interpreter Python or tools in that user …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-52200] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-59821] LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.…

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment …

nvdaltovulnerabilidad CVSS 7.2 NVD

K Crítico vulnerabilidad

06/07/2026

[CVE-2026-57572] Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv…

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together with --no-zygote, causing Chromium to fork or exec an attacker-controlled command as the container's …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-48614] An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject …

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14749] A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be…

A vulnerability was identified in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. Impacted is the function eval of the file application/pages/imba_calculator/calculate.php. The manipulation of the argument mathematical_sentence leads to code injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a r…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14722] A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown funct…

A vulnerability was found in tiddly-gittly TidGi-Desktop up to 0.13.0. This impacts an unknown function of the file src/services/wiki/wikiWorker/loadWikiTiddlersWithSubWikis.ts of the component Git Repository Import. The manipulation results in code injection. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

N Alto vulnerabilidad

04/07/2026

[CVE-2026-12252] In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, Stanfor…

In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vulnerable to untrusted JAR code execution. These classes accept user-controllable JAR paths and execute them via the `java()` function, which invokes `subprocess.Popen()` without integrity verification. Th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-57624] Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-27436] Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.

Editor Arbitrary Code Execution in Five Star Business Profile and Schema

nvdcriticovulnerabilidad CVSS 9.1 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14407] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14383] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-54074] Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote …

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into tha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58454] JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution…

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the c…

nvdaltovulnerabilidad CVSS 7.5 NVD