Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-95588] Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-67105] HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could al…

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79899] Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility…

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56589] HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, whic…

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-62073] Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

Unauthenticated Broken Access Control in WP Full Stripe Free

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103687] A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the f…

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103068] Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools <= 1.2.2 version…

Subscriber Privilege Escalation in ByteCoreStack &#8211; MCP Connector for AI Tools

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102378] Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Parallax Section block

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2024-58388] Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclu…

Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../ to access files outside the intended manual directory, inclu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-100514] Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in REST API Log

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-100517] Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 …

Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-66246] iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to expl…

iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modification or deletion of sensitive application data.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102504] Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_…

Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the channel count with no overflow check, so a negative or very large count requests an excessive allocation. When it fails, Imager's allocator calls exit(3). Passing an u…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-62059] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-62060] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103067] Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful…

Cross-Site Request Forgery (CSRF) vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Cross Site Request Forgery.This issue affects Memberful - Membership Plugin: from n/a through 1.81.0.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103338] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-102379] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC Builder: from n/a through 1.0.28.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad XXE alta en Apache Camel Quarkus permite lectura de archivos locales

Apache Camel Quarkus versiones 3.2.0-3.33.2 y 3.34.0-3.39.x contienen una vulnerabilidad de inyección XXE (XML External Entity) en su extensión de soporte XSLT que permite a atacantes leer archivos locales o realizar solicitudes a sistemas internos. Empresas en México y LATAM que usan Camel Quarkus en pipelines de integración de datos quedan expuestas a filtración de credenciales y configuraciones sensibles.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/10/2026

Vulnerabilidad SSRF alta en Budibase 3.41.0 afecta generación de tablas con IA

Budibase versiones hasta 3.41.0 contiene una vulnerabilidad de Server-Side Request Forgery (SSRF) en la función de generación de tablas con IA. Usuarios autenticados pueden explotar la función uploadUrl en fileUtils.ts para enviar solicitudes a URLs internas, obteniendo acceso a recursos sensibles del servidor. El impacto afecta especialmente a empresas en LATAM que usan Budibase en entornos productivos sin aislamiento de red adecuado.

nvdaltovulnerabilidad CVSS 7.7 NVD