Alertas de Seguridad de la Información

M Alto vulnerabilidad

18/08/2026

[CVE-2026-49226] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplic…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-49227] Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stor…

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75898] RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "In…

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, un…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-59940] Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify cap…

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-32468] Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-28568] Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

Vulnerabilidad de autorización en ArcadeDB versiones ≤26.7.3 permite eliminación no autorizada de funciones

ArcadeDB antes de la versión 26.8.1 contiene una falla de autorización que permite a cualquier usuario con acceso a la base de datos ejecutar DELETE FUNCTION sin validación de permisos. Un atacante puede eliminar funciones del servidor comprometiendo la integridad de aplicaciones que dependen de ArcadeDB en infraestructuras altas de LATAM. La vulnerabilidad (CVSS 7.1) afecta principalmente a bases de datos expuestas internamente o en entornos multi-tenant.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

18/08/2026

Vulnerabilidad alta en ArcadeDB: falla de autorización en plugin Gremlin (CVE-2026-75853)

El plugin Gremlin de ArcadeDB versiones ≤26.7.3 autentica conexiones pero no valida permisos de acceso a bases de datos, permitiendo que credenciales válidas accedan a cualquier base de datos sin autorización. Esto afecta directamente a empresas con infraestructuras de bases de datos distribuidas en LATAM que dependen del control granular de accesos. La vulnerabilidad tiene puntuación CVSS 8.8, indicando impacto alta en confidencialidad e integridad de datos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/08/2026

Vulnerabilidad crítica de autenticación en ArcadeDB anteriores a 26.8.1 (CVE-2026-75854)

ArcadeDB versiones anteriores a 26.8.1 presentan una vulnerabilidad crítica (CVSS 9.8) en el plugin de protocolo Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto Redis y ejecutar comandos arbitrarios contra cualquier base de datos del servidor sin proporcionar credenciales. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan ArcadeDB en entornos de producción con acceso a redes inseguras o expuestas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

18/08/2026

Vulnerabilidad alta de autorización en Plugin API de Grav (CVE-2026-75836)

El plugin API de Grav anterior a versión 1.0.14 presenta una falla en la validación de autorización en el endpoint POST /api/v1/menubar/actions/{plugin}/{action}, permitiendo a usuarios autenticados ejecutar acciones administrativas sin permisos explícitos. La vulnerabilidad afecta principalmente a instancias de Grav con admin-next/API stack expuestas en entornos de producción. Con CVSS 8.8, representa un riesgo alta para sitios web y portales corporativos en LATAM que utilizan este CMS.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/08/2026

Vulnerabilidad crítica en Grav anterior a 2.0.14 permite escalada de privilegios a super-admin

Grav antes de la versión 2.0.14 no valida correctamente el campo de acceso en el blueprint de grupos, permitiendo que operadores con permisos de admin.users escalen privilegios a super-admin. Esto habilita acceso a funciones críticas como evaluación Twig y scheduler, comprometiendo la integridad de sitios web en producción. El impacto afecta especialmente a portales corporativos y plataformas de contenido en empresas mexicanas y latinoamericanas que hospedan instancias de Grav.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-75626] SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including s…

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-15371] Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the…

Velociraptor's web GUI allows specifying a custom type for columns in tables. The URL type takes the cell value and forms a URL which can be clicked in the GUI.The code does not limit the schemes allowed in this URL , allowing an attacker to specify a JavaScript scheme exposing the user to XSS.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75091] The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnera…

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75111] Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoi…

Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-75482] SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that j…

SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network clie…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-71518] Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download rou…

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-73410] Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outbo…

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resolve the hostname again. A builder could use DNS rebinding to make packages/server/src/integrations/rest.…

nvdaltovulnerabilidad CVSS 8.5 NVD