Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

23/06/2026

[CVE-2026-13007] Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose…

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs …

N Crítico vulnerabilidad

23/06/2026

[CVE-2026-54309] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browse…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge e…

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

L Alto vulnerabilidad

21/06/2026

[CVE-2026-12795] A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps…

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosu…

N Crítico vulnerabilidad

19/06/2026

[CVE-2026-9142] There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is n…

There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback. This may allow an unauthenticated user access to the server on the local network. This affects NI grpc-device 2.17.0 and prior versions.

J Crítico vulnerabilidad

19/06/2026

[CVE-2026-50242] In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 20…

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

P Crítico vulnerabilidad

19/06/2026

[CVE-2026-12046] Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_i…

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/ and POST /sqleditor/initialize/sqleditor/update_connection/// -- were the only routes in the module missing the @pga_login_required decorator. Both reach a pickle.loads sink on session['gridData'][]['command_obj']: the close endpoint via close_sqleditor_session(), and up…

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-54130] Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disc…

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-49257] mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. I…

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL query execution, schema creation, and table-config mutation, are reachable by any network-adjacent caller. The server proxies these calls us…

M Crítico vulnerabilidad

18/06/2026

[CVE-2026-54103] The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civil…

The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing System (EDS) does not authenticate password change requests to the '/update-profile/N' API endpoint. A remote, unauthenticated attacker could change an arbitrary user's password.

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-48814] Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP …

Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw (with Access-Control-Allow-Origin now set only for localhost origins), but the empty-default-secret flaw d…

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-55196] Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration…

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication, allowing attackers…

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53869] Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows…

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.

R Alto vulnerabilidad

17/06/2026

[CVE-2026-30799] Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plu…

Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.*, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

D Alto vulnerabilidad

17/06/2026

[CVE-2026-35065] Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critica…

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12199] A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown…

A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (`/SHUTDOWN%20THE%20SERVER`) to terminate the process immediately via `os._exit(0)`. This results in a denial of service, impacting se…

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46972] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46973] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46959] Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Inte…

Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Subledger Accounting. Successful attacks of this vulnerability can result in takeover of Oracle Subledger A…

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46961] Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component…

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Portfolio Analysis. Successful attacks of this vulnerability can result in takeover of Oracle P…

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?