Alertas de Seguridad de la Información

L Alto vulnerabilidad

16/06/2026

[CVE-2026-46331] In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial CO…

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hint does not account for the runtime header offset added by typed keys. This can leave part of the write region un-COW'd. Fix by moving skb…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-6933] The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing auth…

The Premmerce Dev Tools plugin for WordPress is vulnerable to Remote Code Execution via missing authorization in versions up to and including 2.0. This is due to the 'generatePluginHandler' function lacking any authorization check before processing user-supplied POST data, combined with the 'createFromStub' function performing unsanitized string substitution of the 'premmerce_plugin_namespace' par…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8443] The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 's…

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'stypes' and 'slocations' parameters of the wppro_get_overall_chart_data AJAX action in versions up to, and including, 12.6.8. This is due to the use of stripslashes() on user-supplied JSON strings prior to json_decode(), which removes the escaping applied by WordPress's wp_magic_quotes; the resulting decoded arra…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-7273] A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versi…

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

nvdaltovulnerabilidad CVSS 8.8 NVD

D Alto vulnerabilidad

16/06/2026

[CVE-2026-12161] Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permis…

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote…

nvdaltovulnerabilidad CVSS 8.8 NVD

W Alto vulnerabilidad

16/06/2026

[CVE-2026-48907] Vulnerabilidad explotada activamente en Widget Factory Joomla Content Editor

CISA confirma explotación activa de una vulnerabilidad en Widget Factory Joomla Content Editor. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-06-19.

widget factoryexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48723] The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on Browse…

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, t…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12205] Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key …

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected versio…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

15/06/2026

[CVE-2026-48713] Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when u…

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in l…

nvdcriticovulnerabilidad CVSS 9.1 NVD

I Crítico vulnerabilidad

15/06/2026

[CVE-2026-48714] i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti…

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-k…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-12087] Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_s…

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then c…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48017] DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reade…

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user (with basic access, no special permissions required) can inject arbitrary JavaScript code that executes on the server with…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-11832] Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The defa…

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-9691] Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, …

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52694] Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52695] Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52697] Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Subscriber SQL Injection in Taskbuilder

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52699] Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions.

Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52700] Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.

Subscriber SQL Injection in WCMultiShipping

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-52702] Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

Unauthenticated Cross Site Scripting (XSS) in SEO Redirection

nvdaltovulnerabilidad CVSS 7.1 NVD