Alertas de Seguridad de la Información

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54781] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-59822] LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.…

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a va…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58253] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-9695] An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2…

An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55076] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37270] Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused…

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37271] Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, T…

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

nvdcriticovulnerabilidad CVSS 9.8 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55075] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean …

nvdaltovulnerabilidad CVSS 7.4 NVD

D Crítico vulnerabilidad

07/07/2026

[CVE-2026-53483] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 an improper authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This is a critical s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40138] A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Re…

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configur…

nvdaltovulnerabilidad CVSS 8.1 NVD

B Crítico vulnerabilidad

06/07/2026

[CVE-2026-40139] A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Re…

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

06/07/2026

[CVE-2026-53913] Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failin…

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-keycloak guards a route by running KeycloakSecurityProcessor.beforeProcess(), which performs three checks in sequence: it rejects a request that carries no access token, then - only if requiredRoles is no…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14622] A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d…

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product ado…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58423] LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repo…

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-52830] fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer…

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legac…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-11387] The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for …

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56219] Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rb…

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-41896] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently …

nvdaltovulnerabilidad CVSS 7.5 NVD