Alertas de Seguridad de la Información

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-84738] The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through…

The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85122] The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted va…

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-18912] ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection…

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-18911] ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass…

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.

nvdaltovulnerabilidad CVSS 7.5 NVD

? Crítico alerta

18/09/2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog. CVEs relacionados: CVE-2025-39682.

cisaus-certalerta CISA KEV

? Crítico alerta

18/09/2026

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA emite alerta de seguridad: CISA Adds Two Known Exploited Vulnerabilities to Catalog. CVEs relacionados: CVE-2025-39964, CVE-2026-53266.

cisaus-certalerta CISA KEV

M Alto vulnerabilidad

18/09/2026

[CVE-2026-17086] The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulner…

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93371] A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue aff…

A security vulnerability has been detected in marcopiovanello yt-dlp-web-ui up to v4. This issue affects the function NewGenericDownload of the file server/internal/downloaders/generic.go. Such manipulation of the argument params leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is c7ad3bd79c7c52…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-93467] The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote…

The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93468] The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote att…

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Medio vulnerabilidad

18/09/2026

Chromium: CVE-2026-0899 Out of bounds memory access in V8

Microsoft publica advisory de seguridad: Chromium: CVE-2026-0899 Out of bounds memory access in V8.

Microsoft MSRC

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93456] django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin…

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93331] A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_par…

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93450] go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON pars…

go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded recursion with no depth limit. Remote unauthenticated attackers can submit deeply nested JSON documents to services accepting OpenAPI specifications, causing fatal stack overflow that terminates the process and all in-flight requests.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93452] snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer,…

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93453] SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the a…

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastruc…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-85878] Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate pri…

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-85887] Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker …

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-83946] Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal…

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

18/09/2026

[CVE-2026-69843] Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate pri…

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD