Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-49085] Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formida…

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-49104] Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForm…

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-49105] Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidabl…

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-49109] Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elem…

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-49070] Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.

Unauthenticated Broken Access Control in Knit Pay

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48873] Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.

Unauthenticated Broken Access Control in Montonio for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48708] OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and pr…

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or m…

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

15/06/2026

[CVE-2026-47261] Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a file…

Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling O…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-45439] Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

Unauthenticated SQL Injection in Realtyna Organic IDX plugin

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-42668] Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versi…

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-53704] A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a…

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using re_skip_pascal_string() without validating that offsets remain within the mapped buffer. Additionally, the element count controlling the parsing loop is read from…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52719] An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad.…

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causing downstream parsing to read beyond the provided input buffer, leading to a crash or potential informa…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52722] A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream…

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor dimensions can overflow signed integer payload-size arithmetic, bypassing a length check and leading to out-of-bounds reads. A remote attacker could trick a user into opening a specially crafted VMnc file, potentially causing a crash or information disclosure.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50881] Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor priv…

Incorrect access control in the impworks Bonsai v6.0 allows authenticated attackers with Editor privileges to escalate privileges to Administrator and execute unauthorized account, password, and configuration changes.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50882] An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Den…

An issue in the /api/v0/pastes endpoint of anna-is-cute paste v0.1.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50884] Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administr…

Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

15/06/2026

[CVE-2026-50889] An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a…

An input handling flaw in the HTTP refresh token process of LLDAP v0.6.2 allows attackers to cause a Denial of Service (DoS) via sending a crafted refresh-token header.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50874] An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Remi…

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50877] An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying f…

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50878] An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to ca…

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

nvdaltovulnerabilidad CVSS 7.5 NVD