Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Magistrala: Motor de reglas permite ejecución remota de código

El motor de reglas de Magistrala permite a usuarios autenticados crear reglas con scripts Go o Lua que se ejecutan en el servidor cuando llegan mensajes IoT. El intérprete Yaegi expone la librería estándar de Go completa (incluidos módulos os y net/http), permitiendo a atacantes autenticados ejecutar código arbitrario con acceso al sistema operativo. Esta vulnerabilidad afecta altas despliegues IoT en manufactura, utility y ciudades inteligentes en LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71232] MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP fu…

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. Combined with ThinkPHP's {if} template tag, which embeds the condition attribute directly into raw PHP …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-70553] MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to …

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/databa…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-69100] LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execu…

LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attackers can write or influence the script field via message template endpoints to execute arbitrary Groovy code and OS commands on the backend …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18770] A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e…

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-16623] The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before…

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-18667] A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privi…

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-61523] WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that …

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable p…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69088] Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::…

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing rights (admin.pages, not super-admin or admin.pages_twig) can plant a directive in a page's form-fi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en ArcadeDB permite ejecución de comandos del sistema operativo

ArcadeDB versiones anteriores a 26.7.2 contiene una vulnerabilidad que permite a usuarios autenticados con permisos de UPDATE_SCHEMA crear triggers JavaScript maliciosos que ejecutan comandos del sistema operativo mediante java.lang.Runtime. Empresas en LATAM que utilizan ArcadeDB en producción para bases de datos críticas están expuestas a compromiso total del servidor si no aplican el parche inmediatamente.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/08/2026

[CVE-2026-16144] The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote C…

The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the 'thisPermalink' field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-68770] sentence-transformers contains a security control bypass vulnerability that allows attackers to achi…

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within sentence_transformers/util/misc.py, where the guard condition includes an 'or os.path.exists(model_name_or_path)' clause that satisfies the trust gate whenever the supplied path exists on the local files…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-53510] Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates atta…

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

31/07/2026

[CVE-2026-17561] Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecom…

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-13392] The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget d…

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbitrary PHP code to run on the server; on a multisite network this lets a non-supe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-12946] IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the …

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-61536] Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3,…

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Py…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-18245] Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allo…

Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values due to insufficient coverage and effectiveness of the input validation introduced for CVE-2025-…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-13435] IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the Pyt…

IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-14602] The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing use…

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

nvdcriticovulnerabilidad CVSS 9.0 NVD