Alertas de Seguridad de la Información

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41031] A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Bui…

A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.

nvdaltovulnerabilidad CVSS 8.7 NVD

S Alto vulnerabilidad

09/06/2026

[CVE-2026-24349] A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC …

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 (All versions), SIMATIC WinCC Unified PC Runtime V18 (All versions), SIMATIC WinCC Unified PC Runtime V19 (All versions), SIMATIC WinCC Unified PC Runtime V20 (All versions), SIMATIC WinCC Unified PC Runtime V21 (All versions < V21 Update 2). Insufficient protection of k…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-8365] The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Executi…

The Blocksy theme for WordPress is vulnerable to PHP Object Injection leading to Remote Code Execution via the 'blocksy_meta' REST API field and the V200 database migration in versions up to and including 2.1.35. This is due to insufficient input sanitization in the blocksy_sanitize_post_meta_options() function, which only blocks values containing '' and does not prevent serialized PHP obj…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Crítico vulnerabilidad

09/06/2026

[CVE-2026-44083] An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagi…

An authorization bypass through user-controlled key vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to gain unintended privileges. We have already fixed the vulnerability in the following version: QuMagie 2.9.1 and later

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11572] Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command In…

Versions of the package degit before 2.8.6, from 3.0.0 and before 3.3.1 are vulnerable to Command Injection due to improper sanitisation of user input for git shell commands directly invoked with exec() method by _cloneWithGit() and fetchRefs() functions. An attacker can execute arbitrary operating system commands as the process user by supplying a specially crafted git repository name.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-9662] The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all v…

The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in the `recover_exit()` function. This makes it possible for unauthenticated attackers to perform path traversal and include…

nvdaltovulnerabilidad CVSS 8.1 NVD

V Alto vulnerabilidad

09/06/2026

[CVE-2026-41849] An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (…

An integer overflow vulnerability exists in the evaluation logic of the Spring Expression Language (SpEL). An attacker can exploit this by supplying a specially crafted SpEL expression that triggers excessive resource consumption, resulting in a Denial of Service (DoS). Affected versions: Spring Framework 5.3.0 through 5.3.48.

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

09/06/2026

[CVE-2026-41850] Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerabl…

Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions are vulnerable to an Algorithmic Denial of Service (DoS). By providing a specially crafted expression, an attacker can trigger excessive resource consumption during evaluation, leading to application degradation or unavailability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.…

nvdaltovulnerabilidad CVSS 7.5 NVD

V Alto vulnerabilidad

09/06/2026

[CVE-2026-41842] Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving…

Spring MVC and WebFlux applications are vulnerable to Denial of Service (DoS) attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-40983] In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a…

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0 through 1.15.11.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-40984] In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a…

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.18; 1.9.0 through 1.9.17. micrometer-jetty11 1.16.0 through 1.16.5; 1.15.0 through 1.15.11; 1.14.0 through 1.14.15; 1.13.0 through 1.13.1…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-7556] The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment text in all versions up to, and including, 7.5.49.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requ…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11618] A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function pr…

A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disc…

nvdaltovulnerabilidad CVSS 7.3 NVD

E Medio amenaza

09/06/2026

Cybercriminals: the 'auditors' you never hired

ESET Research publica: Cybercriminals: the &apos;auditors&apos; you never hired. Every organisation gets audited. The question is who does the auditing.

esetthreat-researchbusiness-security Editorial

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-40128] SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a …

SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11582] A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is…

A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-52778] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability e…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of YesWiki. The application attempts to sanitize user-defined mathematical formulas using a complex recursive regular expression before passing them to the PHP eval() function. This implementation is inherently flawed: it is vulnerable to Regu…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/06/2026

[CVE-2026-11393] Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI be…

Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat actor to execute arbitrary code on AWS AgentCore Runtime under the imported agent's IAM execution role and on the local environment of another user in the same AWS account, via a crafted collaborationInstruction stored on a Bedrock Agent collab…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11557] A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function f…

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-11556] A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWrit…

A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component Web Management Interface. Performing a manipulation of the argument mac results in os command injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 8.8 NVD