Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad alta de bypass de autenticación en YesWiki anteriores a 4.6.7

YesWiki antes de la versión 4.6.7 contiene una vulnerabilidad de bypass de autenticación en la bandeja de entrada ActivityPub que no vincula correctamente la firma HTTP verificada con el actor de la actividad. Atacantes no autenticados pueden utilizar cualquier par de claves ActivityPub para enviar actividades Delete o Update firmadas, permitiendo eliminar o sobrescribir entradas federadas de otros actores, especialmente en sistemas colaborativos y wikis corporativas.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104447] YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAct…

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to remove extensions like bazar, breaking core site functionality.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104435] Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 tra…

Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SINGLE that lack a corresponding output. Attackers can broadcast crafted V5 transactions with more inputs than outputs that Zebra accepts but zcashd rejects, causing a network consensus split.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104437] Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verific…

Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transparent signature verification, computing a ZIP-244 digest for SIGHASH_SINGLE inputs lacking corresponding outputs instead of failing. Attackers can craft V5 transactions with fewer outputs than inputs that Zebra accepts and templates via getblocktemplate, producing blocks zcashd rejects.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104430] Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mo…

Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mode, overcounting CHECKMULTISIG preceded by OP_1 through OP_16 as 20 sigops and causing a consensus divergence. Remote attackers can broadcast P2SH spends using low-threshold multisig redeem scripts so that a block zcashd accepts exceeds Zebra's inflated MAX_BL…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104431] Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to s…

Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresp…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104422] The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalida…

The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's height from its unvalidated coinbase scriptSig and drops blocks that appear too far behind the tip before consensus validation, without penalizing the supplying peer. Because V5 transaction IDs exclude the scriptSig, a malicious peer can repeatedly serve a canonical block whose coinbase claims height 1 while keeping the re…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104423] Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows un…

Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verification by pushing V6 mempool transactions with invalid Halo2 proofs. Attackers can flood the shared unprioritized Halo2 verification queue with zero-fee transactions carrying zero-filled Orchard and Ironwood proofs, causing nodes to fall behind the chain tip.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104414] Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows atta…

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost editor, published site, and newsletter emails, compromising staff admin sessions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104416] Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API th…

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104418] Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authentic…

Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability that allows authenticated administrators to run code by abusing theme translation file loading. Attackers with administrator access can upload a crafted theme containing malicious translation files to execute arbitrary code on the Ghost server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104410] SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to …

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104411] Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta…

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to compromise other staff users' admin sessions.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104413] Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows sta…

Ghost from 5.94.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users, including Contributors, to host arbitrary HTML by abusing bookmark card image fetching. Attackers can create bookmark cards that store non-image files from external websites as icons or thumbnails to compromise other staff users' admin sessions.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-80298] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-87920] The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Con…

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Thi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103552] Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a de…

Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-80443] Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adve…

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Chatbot Platform: before 2.1.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97663] The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripti…

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This require…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-97342] The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-…

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a use…

nvdaltovulnerabilidad CVSS 7.2 NVD