Alertas de Seguridad de la Información

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-12877] The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti…

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-14172] Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated…

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-16870] Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allo…

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by uploading a file with a crafted encryption metadata field to a shared internal stage that a victim proces…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66138] In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can ach…

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66140] Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequ…

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-66141] Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport i…

Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56191] Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp…

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56165] Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over…

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-54120] Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a …

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-50517] Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over…

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-35425] Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code…

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-28698] Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a…

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-40430] Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability …

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-42933] Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerabilit…

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-63732] 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (…

9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host head…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65604] Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open …

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against an empty parsed_body, so policies that deny requests based on body content are not enforced and forb…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65694] Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller …

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET request exploiting the failure of normalize_path() to strip traversal sequences, disclosing sensitive file…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16765] A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unk…

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

23/07/2026

[CVE-2026-16804] Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had c…

Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

23/07/2026

[CVE-2026-16805] Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execut…

Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD