Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/06/2026

[CVE-2026-56382] Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and <= 5.9.13 contain a remote code exec…

Craft CMS (composer package craftcms/cms) versions >= 5.5.0 and

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-56242] Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_…

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns the owning user_id for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys to confirm key validity and map keys to user identifiers, then chain results into other exposed RPCs…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-56253] Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_member…

Capgo before 12.128.2 contains an improper access control vulnerability in the public.get_org_members RPC function that allows unauthenticated attackers to enumerate organization members. Attackers can invoke the endpoint using only the public sb_publishable_* key and an organization UUID to retrieve sensitive member information including email addresses, user IDs, roles, and pending invitations.

nvdaltovulnerabilidad CVSS 7.5 NVD

K Crítico vulnerabilidad

21/06/2026

[CVE-2026-56265] Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT…

Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing authentication and gaining full access to protected functionality.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12786] A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this i…

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64.sys of the component Kernel Driver. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

21/06/2026

[CVE-2026-12795] A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps…

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12782] A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is a…

A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the component Kernel Driver. The manipulation results in improper access controls. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The affected component should be upgraded. The vendor ex…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12784] A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown fu…

A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel Driver. This manipulation causes improper access controls. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12781] A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unk…

A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor explains: "We have confir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12778] A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affect…

A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12779] A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unkno…

A vulnerability was found in AOMEI Dynamic Disk Manager up to 10.10.1. This issue affects some unknown processing in the library ddmdrv.sys of the component Kernel Driver. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12780] A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in th…

A vulnerability was determined in AOMEI Backupper up to 8.3.0. Impacted is an unknown function in the library amwrtdrv.sys of the component Kernel Driver. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12775] A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909…

A vulnerability was detected in Montodel House-Rental-Management up to 90010017b81265eb1ef3810268909f7719a33863. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery…

nvdaltovulnerabilidad CVSS 7.3 NVD

L Alto vulnerabilidad

21/06/2026

[CVE-2026-12773] A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyA…

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The ven…

nvdaltovulnerabilidad CVSS 7.3 NVD

V Alto vulnerabilidad

20/06/2026

[CVE-2026-56340] vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings p…

vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with p…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-56345] AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecord…

AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an au…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2020-37255] WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows un…

WordPress Time Capsule Plugin 1.21.16 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by sending a crafted POST request with the IWP_JSON_PREFIX header. Attackers can exploit this flaw to obtain valid administrator session cookies and access the WordPress dashboard without providing credentials.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2022-50972] WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute ar…

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers can send requests to the class-wc-meta-box-product-images.php endpoint with unsanitized product-type values to write malicious PHP files to the web root.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/06/2026

[CVE-2019-25763] WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability…

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and a…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-11912] The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insuff…

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() ch…

nvdaltovulnerabilidad CVSS 7.5 NVD