Alertas de Seguridad de la Información

M Crítico vulnerabilidad

12/09/2026

RCE crítica en The Events Calendar para WordPress hasta v6.17.3

The Events Calendar plugin para WordPress es vulnerable a Ejecución Remota de Código (RCE) en todas las versiones hasta 6.17.3. La vulnerabilidad existe en la función parse_array() debido a validación insuficiente del mapa 'classes' del widget, permitiendo que payloads de arrays simples eluda el control is_safe_widget_instance() y alcance el punto de invocación de funciones. Afecta directamente a sitios WordPress en México y LATAM que utilizan este plugin popular para gestión de eventos.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-14560] The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded fi…

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81940] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-81204] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-79742] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-78571] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-52098] An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/predict…

An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81803] Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

Subscriber Remote Code Execution (RCE) in RepairBuddy

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-80352] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML…

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-19584] Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature…

Velociraptor allows for the creation of notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query which will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/09/2026

Vulnerabilidad alta en GitPython anterior a 3.1.60 permite ejecución de código arbitrario

GitPython versiones anteriores a 3.1.60 no valida correctamente la ubicación del directorio git, permitiendo que atacantes suplanten directorios git mediante archivos rastreados (gitdir, commondir, HEAD) e inyecten hooks maliciosos de pre-commit. Al ejecutar index.commit() en repositorios clonados o abiertos, se dispara código arbitrario en el contexto del usuario afectado, comprometiendo servidores de CI/CD, máquinas de desarrolladores y sistemas de control de versiones en empresas LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

09/09/2026

[CVE-2026-85978] An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana…

An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization discrepancy between the authentication filter and the servlet dispatcher allows a crafted request to bypass authentication and reach an endpoint that evaluates attacker-supplied script code without sandboxing, resulting in arbitrary code execution. Exploitation re…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-85983] The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This …

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-78463] Improper control of generation of code ('code injection') in Remote Desktop Client allows an unautho…

Improper control of generation of code ('code injection') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-77908] Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an author…

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-76191] Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability th…

Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69806] Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to …

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86732] Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index…

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86730] Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allow…

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger arbitrary object instantiation and code execution through Craft::createObject().

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-34223] A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC Click…

A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected applicatio…

nvdaltovulnerabilidad CVSS 8.2 NVD