Alertas de Seguridad de la Información

M Crítico vulnerabilidad

12/08/2026

Inyección SQL ciega crítica en Essekia Tablesome Table versiones hasta 1.2.9

Se ha identificado una vulnerabilidad de inyección SQL (CVE-2026-66659) en Essekia Tablesome Table que permite a atacantes ejecutar consultas SQL no autorizadas sin necesidad de ver respuestas directas (SQL Injection Ciega). Esta falla afecta a organizaciones en México y Latinoamérica que utilizan este componente para gestión de tablas en aplicaciones web, exponiendo bases de datos críticas a acceso no autorizado, robo de datos sensibles y manipulación de registros.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18391] The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unse…

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-18366] The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, di…

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16538] The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collec…

The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-16051] The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages inst…

The wpmudev-updates WordPress plugin before 5.0.1 does not verify the integrity of the packages installed through its remote management interface, nor protect those requests against replay, allowing an attacker able to obtain or replay a valid signed management request to install and execute arbitrary code (remote code execution).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-15039] The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of i…

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en Red Hat Advanced Cluster Management permite robo de tokens de clusters

Se identificó una falla en el componente multicloud-integrations de Red Hat Advanced Cluster Management (RHACM) que permite a usuarios autenticados manipular el controlador GitOpsCluster y redirigir tokens de bearer de clusters spoke hacia namespaces bajo su control. Esta vulnerabilidad (CVSS 9.6) afecta principalmente a empresas en LATAM con infraestructuras multicloud híbridas en Kubernetes, exponiendo credenciales críticas de acceso a recursos en la nube pública y privada.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica en multicloud-integrations permite ejecución de comandos en clusters Kubernetes

Se descubrió una falla en el componente multicloud-integrations que permite a un usuario con permisos de creación de Applications en el cluster hub explotar la validación deficiente de anotaciones para dirigirse a clusters Kubernetes arbitrarios. Un atacante podría forzar la sincronización maliciosa de ArgoCD en clusters spoke, comprometiendo la integridad de aplicaciones críticas en infraestructuras multi-nube. Este riesgo es crítico (CVSS 9.9) para empresas en LATAM que gestionan plataformas DevOps centralizadas.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-68067] The login endpoint on the Mira cloud API accepts any format-valid string in the password field and r…

The login endpoint on the Mira cloud API accepts any format-valid string in the password field and returns a live active session token for the account matching the supplied email address. An attacker could use an email address to control cloud accounts and access hormone record information and account settings.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-67568] The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive heal…

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-5917] libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain…

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository …

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66147] An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in G…

An unauthenticated command injection vulnerability was identified in the GMS Dispatcher Service in GMS 9.5.1 and earlier versions which allows remote attacker to perform remote code execution through specially crafted requests.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48765] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator …

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73032] PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to e…

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval() in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM interception of API requests, or a malicious custom LLM endpoint to execute arbitrary code in Zotero…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73034] DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers …

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66145] An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044)…

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-45618] LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi…

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-16230] The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insuffi…

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73090] PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity…

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server to rewrite another server's video metadata, visibility, media file, and HLS URLs. This issue is fixed …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-73211] PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.upda…

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL query, allowing an unauthenticated remote server to read and write PeerTube database tables, including oAuthToken.accessToken, and take over administrator accounts. This issue is fixed in version 8.1.6.

nvdcriticovulnerabilidad CVSS 9.8 NVD