Alertas de Seguridad de la Información

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-14345] The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress…

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_sho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-4375] The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have bee…

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34158] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to brea…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-42200] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did not sufficiently restrict paths, allowing an authenticated user to write files outside the intended directory and achieve command execution thr…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-42143] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to inject shell metacharacters and execute commands as root when volume operations are triggered. This is…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34152] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is f…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34168] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a storage name containing shell metacharacters and execute commands on managed servers when the resource is …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34058] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without any sanitization or escaping. This parameter is interpolated directly into shell commands e…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34044] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-34047] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.4…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-34048] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes and execute commands on team servers. This issue is fixed in version 4.0.0-beta.471.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34034] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_token setting is used in shell commands without sufficient validation, allowing an authenticated user with access to server Sentinel settings to inject shell syntax and execute commands on the host when Sentinel is restarted. This issue is fixed in version 4.0.0…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34035] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

07/07/2026

[CVE-2026-48908] Vulnerabilidad explotada activamente en JoomShaper SP Page Builder

CISA confirma explotación activa de una vulnerabilidad en JoomShaper SP Page Builder. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

joomshaperexplotación activavulnerabilidad CISA KEV

L Alto vulnerabilidad

07/07/2026

[CVE-2026-55255] Vulnerabilidad explotada activamente en Langflow Langflow

CISA confirma explotación activa de una vulnerabilidad en Langflow Langflow. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

langflowexplotación activavulnerabilidad CISA KEV

J Alto vulnerabilidad

07/07/2026

[CVE-2026-56290] Vulnerabilidad explotada activamente en Joomlack Page Builder

CISA confirma explotación activa de una vulnerabilidad en Joomlack Page Builder. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

joomlackexplotación activavulnerabilidad CISA KEV

A Alto vulnerabilidad

07/07/2026

[CVE-2026-48282] Vulnerabilidad explotada activamente en Adobe ColdFusion

CISA confirma explotación activa de una vulnerabilidad en Adobe ColdFusion. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

adobeexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

06/07/2026

[CVE-2026-42153] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_user and postgres_db) in shell-form commands, allowing an authenticated user to inject commands executed in the database container. This issue is fixed in version 4.0.0-beta.474.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-42204] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host. This issue is fixed in ver…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-34599] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolate…

nvdaltovulnerabilidad CVSS 8.8 NVD