Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108060 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108059 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108059: Observaciones in ‘/Terceros/Create’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108058 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108057 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108056 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108056: NombrePF in ‘/Empresas/Create’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108055 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108054 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108053 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108052 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108051 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108051: Nombre in ‘/Articulos/Create’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.CVE-2026-108050 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows: CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026Clickjacking vulnerability in the Alosuite web application.CVE-2026-108049 · Other software · AM System · reported by cve-coordination@incibe.esMedium 5.1
Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality.CVE-2026-108048 · Other software · AM System · reported by cve-coordination@incibe.esMedium 6.9
Vulnerability due to a lack of request limits in Alosuite’s password recovery functionality. The ‘/Account/resetPwd’ endpoint does not enforce adequate restrictions on the number or frequency of password reset requests sent for a single account. As a result, a remote attacker can repeatedly call the endpoint to generate an unlimited number of password reset emails addressed to a user, causing an email flood and enabling abuse of the password recovery mechanism. The absence of request limits or other controls against automation can harm legitimate users, consume application and email infrastructure resources, and facilitate automated attacks against the password recovery service.
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026Inadequate authorization vulnerability in Alosuite’s user invitation functionality.CVE-2026-108047 · Other software · AM System · reported by cve-coordination@incibe.esHigh 8.6
Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2026Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers.CVE-2026-108046 · Other software · AM System · reported by cve-coordination@incibe.esMedium 6.9
Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated with other companies or users without the appropriate authorization. The vulnerability allows unauthenticated remote attackers to enumerate valid object identifiers and retrieve information that should be restricted to authorized users, resulting in the unauthorized disclosure of application data.
- Product
- ALO Suite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.