Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59955] Apollo is a reliable configuration management system suitable for microservice configuration managem…

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled because requests under /configfiles/raw/{appId}/{clusterName}/{namespace} are parsed for authentication as appId raw instead of the a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59954] Apollo is a reliable configuration management system suitable for microservice configuration managem…

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.2, Apollo ConfigService may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled because ConfigService can accept a non-canonical appId variant during authentication while downstream request handling resolves it to the…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/07/2026

[CVE-2026-44986] Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot expo…

Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-team-invitations, embedded an existing profile id in auth.clj prepare-register-profile, and had auth.clj register-profile issue a session based on the invitation email match without password verification, allowing a registered user to take over…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61435] PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints…

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints (src/praisonai/praisonai/api/agent_invoke.py) when PRAISONAI_CALL_AUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host from request.url.hostname, which is taken from the client-controlled HTTP Host header. A remote, una…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61436] PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing …

PraisonAI before 4.6.78 fails to verify Svix webhook signatures in AgentMail webhook mode, allowing unauthenticated attackers to forge message.received events. Attackers can send crafted JSON payloads to the webhook endpoint to invoke configured agents with arbitrary sender addresses and message content.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-12281] The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode…

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automat…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-5270] An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control…

An authentication bypass vulnerability exists in certain releases of Ciena Navigator Network Control Suite (NCS), Manage Control Plan (MCP), and Blue Planet products. The issue is caused by improper handling of HTTP request paths and headers, which allows an unauthenticated attacker to manipulate requests in a manner that bypasses authentication and associated audit logging controls.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/07/2026

[CVE-2026-45363] ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and…

ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists in the HMAC algorithm. The same path is reached when a keyfinder block or key_fi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50365] Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges ove…

Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-56169] Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges …

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-57107] Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges …

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50338] Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges ove…

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15557] A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the…

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInternalTaskSession/getAuthSession/requireUserAuth/requireProjectAuth/requireProjectAuthLight in the library src/lib/api-auth.ts of the component Internal Task Header Handler. This manipulation of the argument x-internal-user-id request causes improper authentication. Remote exploitatio…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15542] A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of…

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.go of the component Websocket Connection Authentication. The manipulation leads to improper authentication. The attack can be initiated remotely. The pull request to fix this issue awaits acceptance.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15491] A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3a…

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects an unknown part. This manipulation causes missing authentication. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Th…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-15089] vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest regis…

vulnerability in Drupal Commerce guest registration allows . This issue affects Commerce guest registration versions: *.*.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-12761] The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress i…

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55377] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's …

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check accepted any active verification record that belonged to the current user and had isVerified === true. A WebAuthn registration verification record for binding a new passkey could be created and verified with only an existing Account API bearer token, then sent in the log…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

10/07/2026

[CVE-2026-59151] Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted th…

Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a SAMLResponse when deciding which tenant should receive the final token, and the ACS finish logic in api/src/backend/api/v1/views.py recalculated the tenant from user.email instead of binding token issuance to the validated SAML configuration. An authenticated attacker wi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55672] ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2…

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

nvdaltovulnerabilidad CVSS 7.4 NVD