Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-103346] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-104385] Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

Unauthenticated Sensitive Data Exposure in Groundhogg

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-94293] An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH req…

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-57545] Memory corruption when processing draw objects of incorrect type during graphics command list execut…

Memory corruption when processing draw objects of incorrect type during graphics command list execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-57555] Memory Corruption when executing system service routines due to improper handling of user input buff…

Memory Corruption when executing system service routines due to improper handling of user input buffers.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105701] The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to…

The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on t…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105776] A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to…

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. T…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-105778] A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unkno…

A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-39760] Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-41563] Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

Unauthenticated Sensitive Data Exposure in Sitemovr

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105704] A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unk…

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user_id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-105484] A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted el…

A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105486] A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of t…

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d9…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105571] A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function …

A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early throu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-82989] There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a r…

There is an input injection in vCast exposed network services in ViewSonic ViewBoard that allows a remote, unauthenticated attacker to inject arbitrary input into service endpoints via network-based HTTP requests to unauthenticated endpoints

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-82988] There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unkno…

There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated attacker to trigger unprivileged APK installation via serving a malicious APK URL through an unauthenticated download endpoint

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105762] Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/…

Dify is an open-source LLM app development platform. Prior to 1.13.0, the /console/api/remote-files/upload endpoint in api/controllers/web/remote_files.py accepted an attacker-controlled URL without authentication and caused the Dify server to retrieve it. A remote attacker could use the endpoint to send requests to internal services or cloud metadata endpoints, potentially exposing sensitive data…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-105763] Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, …

Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or accoun…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105782] Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, Refe…

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler pro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105471] A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757…

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Impacted is an unknown function of the file signup.php of the component Registration Handler. The manipulation of the argument fname results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks…

nvdaltovulnerabilidad CVSS 7.3 NVD