Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64799] Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users …

Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible fold…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-16723] A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerabi…

A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-9713] The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via …

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-supplied parameters before they are appended directly to a raw SQL query in the find_resource() function — th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-12421] The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field V…

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64600] In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork map…

In the Linux kernel, the following vulnerability has been resolved: xfs: resample the data fork mapping after cycling ILOCK xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, a data fork mapping, and a cow fork mapping. Unfortunately, these two helpers cycle the ILOCK to grab a transaction, which means that the mappings are stale as soon as we reacquire the ILOCK. Currently…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-7232] The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter …

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combi…

nvdaltovulnerabilidad CVSS 7.2 NVD

F Alto vulnerabilidad

23/07/2026

[CVE-2026-15074] @fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request …

@fastify/static up to and including version 10.1.0 fails to reject dot-dot path segments in request pathnames before the file-resolution stage. This is a bypass of the earlier fix for CVE-2026-6414, which only covered encoded forward slashes. Because the underlying send library normalizes dot segments before applying its own path-traversal guard, an unauthenticated attacker can bypass any route-sc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-16632] A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_proto…

A flaw has been found in boazsegev facil.io up to 0.7.4. Affected is the function websocket_on_protocol_error in the library lib/facil/http/parsers/websocket_parser.h of the component WebSocket Frame Parser. This manipulation of the argument on_message causes improper input validation. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of…

nvdaltovulnerabilidad CVSS 7.3 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60369] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60370] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result …

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …

nvdaltovulnerabilidad CVSS 8.0 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60372] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60373] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60439] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60455] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-61246] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60366] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Securit…

nvdcriticovulnerabilidad CVSS 10.0 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60367] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60368] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63684] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various ad…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and i…

nvdaltovulnerabilidad CVSS 8.8 NVD