Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66635] Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web <= 1.2.62 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Slider by 10Web

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19650] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72849] Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff …

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind their chat identity to a victim user's account, enabling impersonation within agent operations and inh…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72658] Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Reque…

Cross-Site Request Forgery (CWE-352) in Kibana can lead to privilege escalation via Cross Site Request Forgery (CAPEC-62). A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issued to Kibana in the context of the viewing user's session.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17069] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-13365] IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could al…

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73482] phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/a…

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logge…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-48551] Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protect…

Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply matching cookie and request parameter values to bypass CSRF protection, enabling unauthenticated attackers to run commands as authorized users via malicious links.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73292] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/pas…

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in ve…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73222] Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the…

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/08/2026

Vulnerabilidad CSRF alta en FreePBX Framework 17.0 permite acciones administrativas no autorizadas

Una vulnerabilidad de falsificación de solicitud entre sitios (CSRF) en FreePBX Framework 17.0 permite a atacantes remotos no autenticados realizar acciones administrativas suplantando a administradores legítimos. Esta falla afecta directamente a sistemas PBX en empresas, centros de contacto y proveedores de telecomunicaciones en LATAM que dependen de esta plataforma para gestionar comunicaciones altas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en OpenYak permite ejecución de código remoto desde navegadores web

OpenYak, un runtime local para modelos de IA con herramientas integradas, presenta una vulnerabilidad crítica (CVSS 9.6) en versiones anteriores a 1.1.3. El backend del escritorio expone una API HTTP sin validación de origen, autenticación de loopback ni enforcement de Content-Type, con política CORS abierta. Cualquier página web visitada mientras OpenYak se ejecuta puede ejecutar comandos arbitrarios en el sistema local, comprometiendo completamente la máquina del usuario.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-16262] The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login fl…

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account (login CSRF), so that the victim's subsequent activity is stored under and readable by the attacker.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-28172] Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70432] A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and…

A cross-site request forgery (CSRF) vulnerability in Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier allows attackers to execute arbitrary code in the context of the Jenkins controller JVM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7326] A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.…

A cross-site request forgery vulnerability in the Admin UI of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a malicious web page to perform administrative actions on the administrator's behalf. This can result in unauthorized changes to security configuration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7444] The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all …

The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the `process_bulk_action()` function of `MWTSA_Stats_Table`. This makes it possible for unauthenticated attackers to delete arbitrary search-term records, including all associated search-history rows, via …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-70376] Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in …

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site a…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-15988] The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to …

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauth_for_authorize function. This makes it possible for unauthenticated attackers to create new administrator accounts with attacker-supplied credentials via a CSRF-ba…

nvdaltovulnerabilidad CVSS 8.8 NVD