Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14753] A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. …

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14690] A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. …

A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58424] Permanent Fork PR Workflow Approval Gate Bypass

Permanent Fork PR Workflow Approval Gate Bypass

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58284] Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute…

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57983] Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass …

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56320] Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a c…

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing the intended org/app authorization boundary.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56249] Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoin…

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.

nvdaltovulnerabilidad CVSS 7.6 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-7663] IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP p…

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.

nvdcriticovulnerabilidad CVSS 9.1 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-6556] @fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount path…

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths (arrays of paths and regular expressions) are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms does not match the actual prefixed request path. Applications that use path-scoped middleware for authen…

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49877] Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console…

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the is…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56231] Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST …

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder comma…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

23/06/2026

[CVE-2026-54012] Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. P…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, update, or import workspace models store arbitrary meta.knowledge entries on their model without checking whether they own or can read the referenced files. Open WebUI then treats meta.knowledge entries of type file as an authorization source in …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49338] gonic is a music streaming server / free-software subsonic server API implementation. Prior to versi…

gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist.view` and `/rest/getPlaylist.view` perform no per-resource authorization. Once authenticated as any user (admin or not), an attacker can delete any playlist owned by any other user (including admin) by passing its `id` and read the full con…

nvdaltovulnerabilidad CVSS 7.1 NVD

C Alto vulnerabilidad

17/06/2026

[CVE-2026-20190] A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sen…

A vulnerability in Cisco ISE and ISE-PIC could allow an unauthenticated, remote attacker to view sensitive information on an affected device. This vulnerability is due to improper authorization checks when a resource is accessed. An attacker could exploit this vulnerability by sending crafted traffic to an affected device. A successful exploit could allow the attacker to gain access to sensitiv…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12204] A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderC…

A vulnerability was determined in ShopXO up to 6.7.1. This vulnerability affects the function OrderClose/OrderSuccess/PayLogOrderClose/GoodsGiveIntegral of the file app/api/controller/Crontab.php of the component Scheduled Task Endpoint. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The v…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2026-47342] A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to o…

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privileges This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-47298] Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code …

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45503] Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose inform…

Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45490] Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-42902] Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges lo…

Improper authorization in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD