Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58424] Permanent Fork PR Workflow Approval Gate Bypass

Permanent Fork PR Workflow Approval Gate Bypass

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28744] Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer to…

Gitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer tokens to bypass repository token scope checks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27775] Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receiv…

Gitea 1.25.5 caches a branch-specific write-permission result across multiple refs in one pre-receive hook session, allowing a per-branch maintainer-edit grant to be reused for other refs and escalate to full repository write access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

03/07/2026

[CVE-2026-27780] Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive…

Gitea versions before 1.26.0 do not fail closed on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28699] Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed…

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28740] Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj…

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-26231] Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to …

Gitea versions up to and including 1.26.1 allow the Allow edits from maintainers permission path to authorize commits to repositories that the user can read but should not be able to write.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-54998] Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privil…

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

02/07/2026

[CVE-2026-8079] In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenti…

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized access to sensitive data and unintended modifications to system configuration.

nvdaltovulnerabilidad CVSS 7.3 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-56842] A malicious actor with access to the network and under certain conditions could exploit an Incorrect…

A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vulnerability found in UniFi Network Application to persist privileges within UniFi Network Application after such access had been removed.

nvdaltovulnerabilidad CVSS 7.5 NVD

L Crítico vulnerabilidad

01/07/2026

[CVE-2026-53492] containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI…

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying sol…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53905] MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hi…

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details. Because vendor contact attempts were unsuccessfu…

nvdaltovulnerabilidad CVSS 7.1 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Crítico vulnerabilidad

30/06/2026

[CVE-2026-48286] Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Auth…

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-57950] ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerabilit…

ruoyi-vue-pro through 2026.05, fixed in commit 5d1fd70 contains a broken access control vulnerability in ErpSaleOrderController that allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations by exploiting an incorrect permission namespace enforcement. Attackers holding shipment-level permissions can perform unauthorized create, update, delete, and read ope…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/06/2026

[CVE-2026-58056] RustDesk gates incoming control messages on per-capability flags rather than on the session's author…

RustDesk gates incoming control messages on per-capability flags rather than on the session's authorized connection type, and a file-transfer session does not clear those flags. A peer holding only a valid FileTransfer authorization can inject keyboard and mouse input and reach the unguarded screenshot and display-capture handlers, acting outside its granted scope.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55188] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an aut…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-55189] RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, …

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM authorization function that the FTP write/list handlers (and the entire HTTP S3 path) use. As a result, any user who can authenticate to the FTP listener — includin…

nvdaltovulnerabilidad CVSS 7.7 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-9640] A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.…

A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54091] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and then evaluate descendant paths against the owner's global and per-user rules using the rebased relative path instead of the original path re…

nvdaltovulnerabilidad CVSS 7.5 NVD