Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69131] Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from …

Unauthenticated Arbitrary File Download in WordPress & WooCommerce Scraper Plugin, Import Data from Any Site

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-60223] Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot <= 13.6.5 versions.

Subscriber Arbitrary File Deletion in WPBot Pro Wordpress Chatbot

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2024-32729] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Quan…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Path Traversal. This issue affects Conversational Forms for ChatBot: from n/a through 1.1.8.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8442] The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions u…

The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8. This is due to missing authorization checks on the wpfb_hide_review and wprp_save_review_admin AJAX handlers combined with insufficient path validation in the wpfb_hidereview_ajax() function, which uses strpos() to check that a stored media URL starts with the expected pre…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-49766] Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

Subscriber Arbitrary File Deletion in WP User Manager

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49061] Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions.

Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40779] Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.

Contributor Arbitrary File Deletion in Link Library

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40769] Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File…

Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-40727] Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.

Sales Representative Arbitrary File Deletion in Groundhogg

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50877] An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying f…

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-50869] An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory t…

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-45390] In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the …

In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory. This is not desired behavior, and tar(1) rejects such extractions, but ocaml-tar decompresses it anyway. The impact is that it allows arbitrary file writes outside of the desired extraction directory (to an attacker that can reach a tar decompression endpoint).

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20081] WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows una…

WordPress Plugin HB Audio Gallery Lite 1.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by manipulating the file_path parameter. Attackers can send requests to the audio-download.php endpoint with directory traversal sequences to access sensitive files like wp-config.php outside the intended gallery directory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20076] WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attacker…

WordPress Simple-Backup 2.7.11 contains multiple vulnerabilities that allow unauthenticated attackers to delete arbitrary files and download sensitive files by manipulating the delete_backup_file and download_backup_file parameters in tools.php. Attackers can exploit insufficient input validation using directory traversal techniques to access wp-config.php, database dumps, and other sensitive file…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12198] A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path …

A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor w…

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

13/06/2026

[CVE-2026-11769] We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity secur…

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-53519] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prio…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-6961] Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Mat…

Mattermost versions 11.6.x

nvdaltovulnerabilidad CVSS 7.6 NVD

L Alto vulnerabilidad

12/06/2026

[CVE-2026-3840] A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a c…

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version string. The `_get_versioned_path()` method in `kedro/io/core.py` directly interpolates user-supplied version strings into filesystem paths without sanitization. This enables an attacker to escape the intended versioned dataset directory and access files outside the expected path. The …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-11846] The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File D…

The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories,  resulting in data destruction or service disruption.

nvdaltovulnerabilidad CVSS 8.1 NVD