Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/07/2026

[CVE-2026-61462] mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that al…

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to redirect GitLab API requests to arbitrary endpoints. Attackers can supply crafted job_id values like ../../../user to escape the intended path prefix and access arbitrary GitLab API resources using the operator's personal access token.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-14480] OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web U…

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename (prog_file) directly into the Programs.File database field and later uses this value as the destination path for an uploaded file without validating or restricting the path. Because Python os.path.join() honors attac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

J Alto vulnerabilidad

10/07/2026

[CVE-2026-59793] In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integr…

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-58192] Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDr…

Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-49145] App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc.…

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include --files-from, so a project .ackrc can set it to a path whose listed files ack then reads and searches. Versi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-6101] The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write…

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwp_save_local_font() function combined with inadequate cleanup that fails to remove nested directories and files. This makes it possible for authenticated attackers, with Author-level access and above, an…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

06/07/2026

[CVE-2026-59194] pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside …

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

06/07/2026

[CVE-2026-59196] pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined dir…

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58293] External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized atta…

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-5821] The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to …

The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-6070] The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deleti…

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce…

nvdcriticovulnerabilidad CVSS 9.1 NVD

C Alto vulnerabilidad

30/06/2026

[CVE-2026-10816] Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, …

Arbitrary File Read (Unauthenticated) in NetScaler ADC and NetScaler Gateway if the access to NSIP, Cluster Management IP or SNIP with management access is enabled

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-8095] The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File …

The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update AJAX handler, where supplying WPFM_DIR_PATH in uppercase evades the unset check and is normalized to wpfm_dir_path by sanitize_key() during u…

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

26/06/2026

[CVE-2026-47214] Docling simplifies document processing by parsing diverse formats and providing integrations with th…

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

nvdaltovulnerabilidad CVSS 7.1 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71333] Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1…

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and chatflowId parameters to upload malicious files to arbitrary directories, potentially enabling remote code execution and server compromise.

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71334] Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnera…

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToSt…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71338] Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoin…

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

nvdcriticovulnerabilidad CVSS 10.0 NVD

F Alto vulnerabilidad

25/06/2026

[CVE-2025-71324] Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /a…

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal bey…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55700] pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename …

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55477] 3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated admini…

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). …

nvdaltovulnerabilidad CVSS 7.2 NVD