Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/10/2026

[CVE-2026-101888] The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability t…

The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators to write arbitrary files outside the intended extraction directory during migration ZIP import. Attackers can craft ZIP entry names with traversal sequences processed by computeExtractionParameters() and resumableZipExtractor() in utilities/PrimeMoverSystemChe…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79896] Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parse…

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-46729] NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener…

NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-47360] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module.   When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-12627] Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability …

Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker with network access to the autoregistration service may be able to trigger memory corruption during client response processing.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97273] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97277] Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Subscriber Broken Access Control in Social Boost

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97284] Contributor PHP Object Injection in Icegram <= 3.1.31 versions.

Contributor PHP Object Injection in Icegram

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97297] Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Subscriber Broken Access Control in Gratisfaction

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97260] Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.

Unauthenticated Cross Site Scripting (XSS) in MaxGalleria

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97268] Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.

Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-94390] Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.

Editor PHP Object Injection in Hide Shipping Method For WooCommerce

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-95588] Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions.

Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-67105] HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could al…

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-79898] Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user a…

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec r…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-79899] Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility…

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-56589] HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, whic…

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

01/10/2026

[CVE-2026-62071] Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

Unauthenticated SQL Injection in WordPress File Upload

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-62073] Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

Unauthenticated Broken Access Control in WP Full Stripe Free

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-103687] A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the f…

A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer.php of the component SVG Sanitization. Such manipulation leads to incomplete blacklist. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.16 is sufficient to fix this issue. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD