Alertas de Seguridad de la Información

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88899] knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in t…

knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88937] knowns through 0.33.0 fails to properly validate template destination paths in the code generation t…

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside the project root. Attackers can supply malicious templates that traverse directories to overwrite shell profiles, steal credentials, or achieve persistent code execution on victim systems.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88939] knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, a…

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88959] Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoi…

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, ga…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88016] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path. MkdirMetadata, writeMetadataToFile, and setTimes operate when Directory.translatedLink=false, so os.Chown, os…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88017] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass map[string]string instead of binding the credential or VFS to the authenticated session. If two accepted credentials use the same username but r…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-88018] rclone is a command-line program to sync files and directories to and from different cloud storage p…

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone serve s3 configured with --auth-proxy but without --auth-key allows authPairMiddleware to register any client-chosen accessKeyID with an empty ws.s3Secret. gofakes3 then verifies the request’s SigV4 signature against that same empty secret, while Server.auth passes …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81467] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81468] Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elem…

Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81046] Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability…

Dell ThinOS 10, versions prior to 2605_10.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81048] Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elemen…

Dell ThinOS 10, versions prior to 2605_10.2616, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote Code execution

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-79987] A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca…

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-4129] There is an improper access control vulnerability in NI SystemLink that may allow an authenticated u…

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-4130] There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulner…

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.  This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88924] A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownersh…

A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can exploit this via a Time-of-Check Time-of-Use (TOCTOU) race condition and exchange the socket pathname with a symbolic link pointing to an ar…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84821] Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.

Unauthenticated Broken Access Control in WP Fast Total Search

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84816] Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WPCS

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84819] Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WPAdverts

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81796] Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.

Unauthenticated Broken Authentication in WP Travel

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81799] Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 version…

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD