Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88017] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but r…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88018] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81467] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81468] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81046] Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability…

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81048] Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elemen…

Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-79987] A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca…

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-4130] There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulner…

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.  This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88924] A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownersh…

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an ar…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84816] Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WPCS

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84819] Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WPAdverts

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81799] Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 version…

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81803] Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

Subscriber Remote Code Execution (RCE) in RepairBuddy

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81804] Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versi…

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81795] Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#8211; Lite <= 1.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter &#8211; Lite

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81789] Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6…

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88889] Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that…

Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary commands by specifying a malicious distributionType parameter in maven-wrapper.properties. Attackers can inject shell commands through unescaped distributionType values to achieve remote code execution when Renovate processes Maven Wrapper updates in binarySour…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88890] OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter bui…

OpenPanel through commit cd24bb8 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analyti…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88891] OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing …

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88885] Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when process…

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary commands as the Renovate user during Go module major version updates with postUpdateOptions gomodUpdateImpo…

nvdaltovulnerabilidad CVSS 7.0 NVD