Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14169] Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent …

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14545] The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a u…

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14870] The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not pro…

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-16585] The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress i…

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_sticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14490] The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to A…

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a publicly accessible subdirectory of the WordPress uploads folder — without any `.htaccess` or index file pr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-17524] Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching m…

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first ext…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-61957] Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-65440] Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.

Unauthenticated Cross Site Scripting (XSS) in GetGenie

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2025-63913] An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted r…

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2021-32086] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcod…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain pri…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2021-32088] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpo…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64775] A memory initialization issue was addressed with improved memory handling. This issue is fixed in iO…

A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64725] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64703] A use after free issue was addressed with improved memory management. This issue is fixed in macOS S…

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64692] An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 a…

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-64541] In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_…

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-64543] In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the…

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipc_disc_rcv() bearer_disable() frees b->disc with tipc_disc_delete()'s plain kfree(), but tipc_disc_rcv() still dereferences b->disc in RX softirq under rcu_read_lock() (tipc_udp_recv -> tipc_rcv -> tipc_disc_rcv). L2 bearers are safe thanks to the synchronize_net() in tipc_disabl…

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43813] A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 a…

A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. A maliciously crafted app may be able to bypass code signing enforcement.

nvdaltovulnerabilidad CVSS 7.1 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43777] This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8…

This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43771] A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia …

A stack overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause a denial-of-service.

nvdaltovulnerabilidad CVSS 7.1 NVD