Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-39793] Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-39769] Unauthenticated Broken Authentication in Graphina <= 3.1.12 versions.

Unauthenticated Broken Authentication in Graphina

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/09/2026

Vulnerabilidad de bypass de autenticación en Taxi Booking Manager for WooCommerce

Taxi Booking Manager for WooCommerce (versiones anteriores a 2.0.8) contiene una vulnerabilidad de bypass de autenticación que permite a atacantes eludir controles de acceso mediante canales alternativos. Esto afecta directamente a agencias de transporte y plataformas de reserva en LATAM que utilizan este plugin, exponiendo datos de clientes y operaciones de negocio. El CVSS 7.3 indica alto riesgo de explotación remota sin autenticación previa.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-58269] Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Pri…

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/token` authenticates with username and password only, then calls `getTokens()`, which returns full access and refresh JWTs without checking whether the account has TOTP 2FA enabled. An attacker with stolen or phished credentials can bypass 2FA in a single request…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-57134] PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src…

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without calling auth.validate(), then return an authenticated result, allowing callers with invalid credentials …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-91143] goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allo…

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81796] Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.

Unauthenticated Broken Authentication in WP Travel

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81783] Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions.

Subscriber Broken Authentication in MailMunch – Grow your Email List

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88861] Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched versio…

Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when the account has a verified MFA factor that has not been used for the session: the Edge JWT middleware (foundJWT() in supabase/functions/_bac…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-83527] An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote…

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

Vulnerabilidad alta de escalada de privilegios en Reyrolle 7SR5 (CVSS 8.8)

Se ha identificado un fallo en los controles de autorización del lado del servidor en la interfaz de gestión web de Reyrolle 7SR5 en todas las versiones anteriores a V2.70. Un atacante autenticado con permisos bajos puede eludir las restricciones de control de acceso basado en roles (RBAC) manipulando datos de solicitudes para escalar privilegios a nivel administrativo. Esto afecta directamente a infraestructuras altas de distribución eléctrica y subestaciones en LATAM que dependen de estos dispositivos de protección.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-76169] fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix t…

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and s…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-84777] Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

Unauthenticated Broken Authentication in Really Simple SSL

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82225] Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

Unauthenticated Broken Authentication in RegistrationMagic

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-82269] Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API …

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-63587] The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the …

The SMS control function of IE-SR-2TX-WL-4G devices can require a password for SMS commands via the 'Enable Password Authorization' setting. The device increments a retry counter on each failed SMS password attempt; after 5 consecutive failed attempts, SMS password authorization is automatically disabled. An unauthenticated remote attacker who is able to send SMS messages to the device can deliber…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78259] Unauthenticated Broken Authentication in WPLegalPages <= 3.7.0 versions.

Unauthenticated Broken Authentication in WPLegalPages

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-66677] Subscriber Broken Authentication in Leyka <= 3.32.3 versions.

Subscriber Broken Authentication in Leyka

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50191] 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerabl…

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-24185] NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configura…

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an alternative authentication path. If best practices for replacing the default password as recommended by NVIDIA are not followed, this alternative authentication path might lead to unauthorized access.…

nvdaltovulnerabilidad CVSS 7.1 NVD