Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100612] Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.…

Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_guard()) that freezes only the dns_verified_at, domain, status and enforce_sso columns; provider_id (as well as metadata_url and attribute_map…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad de suplantación de identidad en OpenClaw (npm) permite escalación de privilegios

El paquete npm 'openclaw' anterior a versión 2026.7.1 presenta una falla alta en la validación de identidad del solicitante en arquitecturas de Gateway con autenticación. Un atacante con permisos de escritura puede suplantar la identidad de otros usuarios para ejecutar acciones de canal no autorizadas. Afecta principalmente a sistemas de integración empresarial en entornos cloud y on-premise en LATAM.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97060] X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub…

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

25/09/2026

Vulnerabilidad crítica en plugin Bookly para WordPress permite acceso no autorizado a datos de reservas

El plugin Bookly para WordPress (versiones hasta 28.2) contiene una vulnerabilidad de Referencia Directa a Objetos (IDOR) en acciones AJAX que permite a atacantes acceder y manipular datos de reservas, sesiones y órdenes sin autenticación. Afecta directamente a negocios de servicios en LATAM que usan este plugin para gestionar citas y pagos online, exponiendo información de clientes y transacciones.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97646] A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca5…

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-77293] TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:…

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any tri…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-96762] A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the fu…

A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosur…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76087] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous form…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hij…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76089] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-no…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs an…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-55610] InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create profe…

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global pr…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-86678] ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user t…

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/09/2026

Vulnerabilidad de Control de Acceso en ManageEngine OpManager y Firewall Analyzer (CVE-2026-84791)

ManageEngine OpManager y Firewall Analyzer versiones 12.8.710 e inferiores contienen una vulnerabilidad de control de acceso deficiente (CVSS 7.1) que permite a usuarios autenticados con privilegios bajos modificar configuraciones de reportes de Change Management en firewalls fuera de su alcance asignado. Esto afecta directamente a empresas en México y LATAM que utilizan estas soluciones para gestión de infraestructura de red y firewall. El riesgo se incrementa en organizaciones con múltiples equipos de operaciones sin segmentación adecuada de permisos.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

Control de acceso roto en ManageEngine OpManager y Firewall Analyzer versión 12.8.710 y anteriores

ZohoCorp ManageEngine OpManager y Firewall Analyzer versiones 12.8.710 e inferiores contienen una vulnerabilidad de control de acceso deficiente (CVSS 7.1) que permite a usuarios autenticados con permisos bajos crear notificaciones de alertas para firewalls fuera de su ámbito asignado. Afecta principalmente a empresas con infraestructura distribuida en LATAM que dependen de estas herramientas de monitoreo de red. El riesgo incluye exposición de configuraciones altas, desviación de alertas de seguridad y movimiento lateral no autorizado.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96271] Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mut…

Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-94462] Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5…

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id but does not require a cart token or otherwise verify possession of the selected guest cart. An authenticated customer can derive reversible …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95655] Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowi…

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94534] lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/av…

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94535] lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpo…

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitrary notice IDs to permanently remove notifications belonging to other users without recipient validation.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-77523] MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model pa…

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwri…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94497] jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints ac…

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

nvdaltovulnerabilidad CVSS 8.3 NVD