Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81786] Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions…

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81789] Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6…

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81783] Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.

Subscriber Broken Authentication in MailMunch – Grow your Email List

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81784] Unauthenticated PHP Object Injection in Wise Chat <= 3.4 versions.

Unauthenticated PHP Object Injection in Wise Chat

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-46387] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Su…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-45747] Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security M…

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88889] Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that…

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySour…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88890] OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter bui…

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analyti…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88891] OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing …

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88893] OpenPanel share lookup procedures fail to validate access controls and return password hashes and pr…

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88895] CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attack…

CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88885] Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when process…

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImpo…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88886] Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE…

Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0), the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository's gradle/wrapper/gradle-wrapper.properties file before invoking the Gradle Wrapper CLI. In self-host…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88887] Renovate is a dependency update automation tool. When listing tags/digests for a container image, Re…

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry. A malicious or compromised container registry can therefore s…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88888] Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processin…

Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in binarySource=docker mode.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88880] Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagi…

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88881] Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HT…

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromis…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88882] Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE…

Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by the registry in the HTTP `Link` header without verifying that the target has the same origin as the c…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88883] Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE…

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88872] AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery…

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.php endpoint that allows unauthenticated attackers to modify any user's channel password by sending a GET request. Attackers can craft a malicious webpage that, when visited by an authenticated administrator, sets or clears any user's channel password without C…

nvdaltovulnerabilidad CVSS 7.1 NVD