Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66667] Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Templately

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66046] Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic compl…

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66621] Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66629] Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-66633] Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-61407] Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Acce…

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-56684] Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey…

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-59825] Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from…

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq backgro…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50187] Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the d…

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-32547] Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-32468] Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-32333] Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-32444] Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Contributor Remote Code Execution (RCE) in Cwicly

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-28568] Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-28569] Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Unauthenticated Cross Site Scripting (XSS) in SSL Zen

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75778] A vulnerability was identified in code-projects Task Management System 1.0. This affects the functio…

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select_with_multiple_condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75783] A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulner…

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

nvdcriticovulnerabilidad CVSS 9.6 NVD