Alertas de Seguridad de la Información

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-19652] The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, an…

The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `password_verify()` against an attacker-controlled bcrypt hash supplied in the `form_id` POST parameter, with no validation or whitelist of allowe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-15897] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function, in its register_login_action='update' flow, trusting an attacker-supplied user_id value and passing it to wp_update_user() without any ownership or capability check. Bec…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-59797] Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-…

Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-95687] The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalatio…

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0 This is due to the plugin not properly validating the target user's role prior to issuing a new authentication session, allowing an authenticated attacker to log in as any WordPress Administrator by directly supplying an Administrato…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-15989] The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalatio…

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316. This is due to the Register & Login add-on's before_email_success_msg() function whitelisting the client-submitted 'role' key and copying it into the user-data array that is passed directly to wp_insert_user(), without validating the submitted role ag…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-19807] The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escal…

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the `wp_update_user_meta` MCP tool in `execute_tool` gating writes solely with `current_user_can('edit_user', $uid)` — a check that WordPress core's `map_meta_cap` resolves to the `read` primitive when the target user ID matches the ca…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102120] A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obt…

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a clustered Kiteworks deployment to run operating system commands with elevated privileges on another node of the same cluster. Insufficient input validation in an internal cluster management function let attacker-supplied values reach a privileged execution conte…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102112] A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained c…

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root and run arbitrary commands with the highest privileges. Exploitation requires existing local access to that service account.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102113] A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained c…

A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path that the lower-privileged account could influence, allowing the attacker to cause a root-owned operation to run arbitrary commands with the high…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102093] Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not corr…

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-53605] Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image fo…

Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local p…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-75823] The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned …

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102317] Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed …

Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102676] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled, allowing untrusted guest content to create a Node-enabled worker with more privilege than…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100820] Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4…

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100824] Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and …

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100801] Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.…

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100807] Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox …

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-101860] A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the functio…

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta de inyección en Zohocorp ManageEngine DDI Central 6.2.0

ManageEngine DDI Central versiones 6.2.0 con build inferior a 6201 contiene una vulnerabilidad de inyección de configuración en Keepalived que permite a operadores autenticados modificar la configuración de alta disponibilidad. Un usuario con rol de operador podría ejecutar comandos con privilegios root en el servidor DDI Central, comprometiendo la integridad de infraestructuras altas de DNS y DHCP en empresas latinoamericanas.

nvdaltovulnerabilidad CVSS 8.8 NVD