PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransomplay reclama a Minor League Baseball · US · Hospitalityransomn0n reclama a Company #213 · QAransomn0n reclama a Company #212 · ETransomdoommageddon reclama a K**** T**** H**** B****ransomcurious worm reclama a sacheminc.com · CA · Manufacturingransomcurious worm reclama a sbhny.org · USransomcurious worm reclama a shannonhealth.com · IE · Healthcareransomcurious worm reclama a baronandbudd.com · GB · Professional Servicesransomeverstake reclama a ki*****o.comransomcurious worm reclama a raleighortho.com · US · Healthcareransomcurious worm reclama a lifelinescreening.com · US · Healthcareransomcurious worm reclama a safcodental.com · SA · Healthcareransomcurious worm reclama a marquiscompanies.com · US · Professional Servicesransomcurious worm reclama a atlashp.com · Technologyransomplay reclama a Minor League Baseball · US · Hospitalityransomn0n reclama a Company #213 · QAransomn0n reclama a Company #212 · ETransomdoommageddon reclama a K**** T**** H**** B****ransomcurious worm reclama a sacheminc.com · CA · Manufacturingransomcurious worm reclama a sbhny.org · USransomcurious worm reclama a shannonhealth.com · IE · Healthcareransomcurious worm reclama a baronandbudd.com · GB · Professional Servicesransomeverstake reclama a ki*****o.comransomcurious worm reclama a raleighortho.com · US · Healthcareransomcurious worm reclama a lifelinescreening.com · US · Healthcareransomcurious worm reclama a safcodental.com · SA · Healthcareransomcurious worm reclama a marquiscompanies.com · US · Professional Servicesransomcurious worm reclama a atlashp.com · Technology

← Todos los CVEs

CVE Watch11 nov 2026

CVE-2026-126233

A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7

CVSS

7.2

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 11 nov 2026 · Última mod.: 11 nov 2026 · CWE-434

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A unrestricted upload of file with dangerous type vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cloud 8.0.0 through 8.0.1, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2.1 through 7.2.12, FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to upload arbitrary files via specially crafted requests.

Referencias oficiales

fortiguard.fortinet.comhttps://fortiguard.fortinet.com/psirt/FG-IR-26-248

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1269324.3 MED

———Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PATCH /api/user/files/:id so /raw/:id serves that Content-Type.3h CVE-2026-1111908.1 ALT

——14The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via its form file-upload handler. The name of the stored file is taken from an attacker-controlled request header and is not adequately restricted to safe file types, and the plugin's file-type and content-safety checks can be evaded, allowing files that contain executable PHP code to be written to a publicly accessible directory. This makes it possible for unauthenticated attackers to upload malicious files to the affected site's server, which may make remote code execution possible. Exploitation requires a published form containing a File field to be publicly accessible on the site.18h CVE-2026-1214979.8 CRÍ

——4The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled.14h CVE-2026-1180418.8 ALT

——6The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution.14h CVE-2026-1073568.8 ALT

——17U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20.1d CVE-2026-600454.9 MED

——8A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities.2d