Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66046] Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic compl…

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66620] Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Editor PHP Object Injection in OptionTree

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66621] Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66622] Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

Unauthenticated SQL Injection in Depicter Slider

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-66627] Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions.

Contributor Arbitrary File Upload in GP Premium

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66629] Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-66633] Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-61407] Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Acce…

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-63639] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-56684] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-59825] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq backgro…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-48798] SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string…

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to c…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-50187] Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the d…

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-32474] Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Contributor Arbitrary File Upload in Templatiq

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32481] Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Unauthenticated Broken Authentication in Ezoic

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32547] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32549] Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD