Alertas de Seguridad de la Información

M Alto vulnerabilidad

27/07/2026

[CVE-2026-13152] The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent …

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-13332] The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unaut…

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-15662] The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not r…

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal r…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Medio vulnerabilidad

27/07/2026

CVE-2026-16461 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting

Microsoft publica advisory de seguridad: CVE-2026-16461 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting.

Microsoft MSRC

M Medio vulnerabilidad

27/07/2026

CVE-2026-16277 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist()

Microsoft publica advisory de seguridad: CVE-2026-16277 Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist().

Microsoft MSRC

F Alto vulnerabilidad

27/07/2026

[CVE-2025-68686] Vulnerabilidad explotada activamente en Fortinet FortiOS

CISA confirma explotación activa de una vulnerabilidad en Fortinet FortiOS. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-08-10.

explotación activavulnerabilidad CISA KEV

A Alto vulnerabilidad

27/07/2026

[CVE-2026-16812] Vulnerabilidad explotada activamente en Arista VeloCloud Orchestrator

CISA confirma explotación activa de una vulnerabilidad en Arista VeloCloud Orchestrator. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-30.

aristaexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

26/07/2026

[CVE-2026-57989] Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo…

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-57990] Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an una…

Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17496] NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injec…

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to inc…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-17497] NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python,…

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

26/07/2026

[CVE-2026-64530] In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_A…

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle tcf_classify() can return TC_ACT_CONSUMED while the skb is held by the defragmentation engine (e.g. act_ct on out-of-order fragments). When that happens the skb is no longer owned by the caller and must not be touched again. tcf_qevent_handle() did not handle TC_AC…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2024-14040] In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight t…

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Increase weight to u16 In CLOS networks, as link failures occur at various points in the network, ECMP weights of the involved nodes are adjusted to compensate. With high fan-out of the involved nodes, and overall high number of nodes, a (non-)ECMP weight ratio that we would like to configure does not fit into 8 bi…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-63720] datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows…

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value is emitted verbatim into a generated 'from ... import ...' statement without identifier validation, cau…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/07/2026

[CVE-2026-15962] The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all v…

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to change user passwords and potentially take over a…

nvdaltovulnerabilidad CVSS 8.8 NVD