Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10706] In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and c…

In Adalo’s no-code app builder, (Versions 1 and 2) the attackers may extract full user records and correlate user behavior across multiple applications via dbId enumeration. The platform does not implement data minimization, privacy by design, or implement appropriate technical safeguards, allowing sensitive information to be exposed to unauthorized parties.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10708] This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A sin…

This vulnerability enables large‑scale data harvesting without requiring app‑specific secrets. A single request to a minimal leaderboard component may return user records containing emails, UUIDs, and custom fields. The combination of wildcard CORS behavior, long‑lived twenty‑day JWTs, and the absence of token revocation allows attackers to gather sensitive personal information from any Adalo appl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56226] Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(…

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(userid uuid), which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it matches the authenticated user, an attacker using only the public publishable API key can query POST /rest/v1/rpc/get_o…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-57245] When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks…

When the application opens a PDF, traverses and builds the annotation elements related to hyperlinks, it fails to validate the abnormal annotation relationships and field combinations. This results in the internal objects entering an invalid state. Eventually, during the destruction phase, an invalid pointer write occurred, causing the application to crash.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-12378] The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does …

The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin through 1.1.28 does not validate data before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects; where a suitable gadget chain is present on the site this can be leveraged to achieve remote code execution.

nvdaltovulnerabilidad CVSS 8.1 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-55428] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGua…

nvdaltovulnerabilidad CVSS 8.2 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-55429] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. `CompleteJob` runs under `db…

nvdaltovulnerabilidad CVSS 8.7 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55077] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. …

nvdaltovulnerabilidad CVSS 7.2 NVD

P Crítico vulnerabilidad

07/07/2026

[CVE-2026-14740] DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial …

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal bu…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Alto vulnerabilidad

07/07/2026

[CVE-2026-49471] Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilitie…

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary c…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-14345] The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress…

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_sho…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34158] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to brea…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34171] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue i…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34044] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.

nvdaltovulnerabilidad CVSS 7.7 NVD

J Alto vulnerabilidad

07/07/2026

[CVE-2026-48908] Vulnerabilidad explotada activamente en JoomShaper SP Page Builder

CISA confirma explotación activa de una vulnerabilidad en JoomShaper SP Page Builder. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

joomshaperexplotación activavulnerabilidad CISA KEV

J Alto vulnerabilidad

07/07/2026

[CVE-2026-56290] Vulnerabilidad explotada activamente en Joomlack Page Builder

CISA confirma explotación activa de una vulnerabilidad en Joomlack Page Builder. No se ha confirmado uso en campañas de ransomware conocidas. Fecha límite para aplicar parche según directiva CISA: 2026-07-10.

joomlackexplotación activavulnerabilidad CISA KEV

M Alto vulnerabilidad

06/07/2026

[CVE-2026-42204] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host. This issue is fixed in ver…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-34153] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume, allowing an authenticated user who can add file s…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

06/07/2026

[CVE-2026-21383] Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requir…

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

nvdaltovulnerabilidad CVSS 7.1 NVD