Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 42 min

[CVE-2026-78212] 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. U…

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta de traversal de directorios en LeafWiki versiones 0.3.0 a 0.10.0

LeafWiki, plataforma wiki autohospedada, contiene una vulnerabilidad de traversal de directorios (CVSS 8.8) en la funcionalidad de renombrado de activos que afecta versiones 0.3.0 a 0.10.0. Un usuario autenticado con permisos de editor puede mover archivos accesibles al proceso del servidor hacia directorios de activos, exponiendo archivos sensibles como bases de datos de aplicaciones para descarga. Esto representa riesgo alta para organizaciones en LATAM que utilizan LeafWiki en entornos corporativos con datos sensibles.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63509] Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over…

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-63490] Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.g…

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplate…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72677] Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources…

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-16230] The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insuffi…

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-70337] Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code…

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-65810] Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges loca…

Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-53416] Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information…

Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-16053] Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to A…

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

09/08/2026

Vulnerabilidad alta de traversal de directorios en LOLLMS 2.1.0 permite acceso no autorizado

LOLLMS versión 2.1.0 contiene una vulnerabilidad de traversal de rutas en su módulo de interfaz (SPA catch-all route) que permite a atacantes eludir controles de seguridad mediante secuencias codificadas en URL (%2e%2e) y acceder a archivos fuera del directorio permitido. Este fallo afecta directamente a servidores de IA/ML en empresas LATAM que despliegan esta solución sin actualizar. La vulnerabilidad tiene puntuación CVSS 7.5 (Alta) y requiere atención inmediata en entornos de producción.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-15802] The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient …

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-54910] FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the…

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed d…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56196] Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a…

Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50454] Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate priv…

Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50663] Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacke…

Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-40400] Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a n…

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-14903] Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker t…

Path traversal in Ivanti  Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

nvdaltovulnerabilidad CVSS 7.7 NVD

J Crítico vulnerabilidad

10/07/2026

[CVE-2026-59792] In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project wor…

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-50181] Langroid is a framework for building large-language-model-powered applications. Prior to version 0.6…

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.64.0, Langroid's `ReadFileTool` and `WriteFileTool` appear to treat `curr_dir` as the intended working-directory boundary for file operations. However, the tools only change the process working directory to `curr_dir` and then operate on the user-supplied `file_path` without resolving and enforcing t…

nvdaltovulnerabilidad CVSS 7.1 NVD