Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56320] Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a c…

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing the intended org/app authorization boundary.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56286] Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoi…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56300] Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_or…

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-55721] Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by t…

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56219] Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rb…

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56233] Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allow…

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in ser…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-50110] Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embed…

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning succ…

nvdcriticovulnerabilidad CVSS 9.2 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52193] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_447CAC component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52195] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_472f08 component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52197] An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of se…

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52198] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_425994 component

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14027] Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convi…

Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14005] Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attack…

Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13825] Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to poten…

Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52196] Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to…

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 component

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-52868] An unauthenticated attacker can read worklist records from a directory outside the intended per-AE w…

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

nvdaltovulnerabilidad CVSS 8.2 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2026-11594] IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in…

IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console.

nvdaltovulnerabilidad CVSS 8.5 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7874] IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due …

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored credentials due to the use of a weak and reversible key derivation mechanism for encryption at rest.

nvdcriticovulnerabilidad CVSS 9.1 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD