Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56703] Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where V…

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-56705] Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowi…

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56707] Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability …

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory contents including user account information, bypassing the authorize ACL enforc…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56709] Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function whe…

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which only covers password reset flows.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-56702] Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUp…

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-34968] Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the data…

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-66766] SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial o…

SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could exhaust system resources and make the service unavailable, resulting in a high impact on availability.…

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

25/08/2026

[CVE-2026-60004] Vulnerabilidad explotada activamente en Gitea Gitea

CISA confirma explotación activa de una vulnerabilidad en Gitea Gitea. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-08-28.

giteaexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78284] Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.

Unauthenticated Arbitrary File Deletion in MasterStudy LMS

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78263] Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78264] Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-78265] Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.

Unauthenticated PHP Object Injection in The Events Calendar

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-78267] Unauthenticated Privilege Escalation in TranslatePress <= 3.3.2 versions.

Unauthenticated Privilege Escalation in TranslatePress

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78268] Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat But…

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78282] Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-77384] libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the re…

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @lib…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78259] Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

Unauthenticated Broken Authentication in WPLegalPages

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-78262] Unauthenticated PHP Object Injection in WP Project Manager <= 4.0.6 versions.

Unauthenticated PHP Object Injection in WP Project Manager

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-32560] Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Gen…

Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-32561] Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions.

Subscriber Privilege Escalation in Booking Hub

nvdaltovulnerabilidad CVSS 8.8 NVD