Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75858] CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code…

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and w…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75859] CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions fiel…

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-71365] A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechan…

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticate…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-55839] Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Mark…

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-45116] MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly…

MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected prof…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-45117] MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not…

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-19500] The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequ…

The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-12564] A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() fu…

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation pri…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-75784] A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the functio…

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-74012] Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.

Editor PHP Object Injection in TaxoPress

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73382] Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73393] Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Unauthenticated Cross Site Scripting (XSS) in Subscribe2

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73375] Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73378] Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73358] Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73360] Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73361] Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18…

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73362] Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73351] Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-73190] Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages <= 7.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in WPDM – Premium Packages

nvdaltovulnerabilidad CVSS 7.1 NVD