Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-56839] PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_ro…

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read a…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-47701] The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.…

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selected ServiceMonitor endpoint's bearerTokenFile value as HTTPClientConfig.Authorization.CredentialsFile. A tenant who can create or update a ServiceMonitor matched by serviceMonitorSel…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-73178] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An admi…

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests, impersonating users with higher administration entitlements. This issue affects Apache Syncope: fr…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-87842] The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check be…

The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account login token, allowing unauthenticated attackers to retrieve it and authenticate to the site owner's linked service account.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88893] OpenPanel share lookup procedures fail to validate access controls and return password hashes and pr…

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown dimensions for offline password cracking and business intelligence theft.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88874] AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enfor…

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::_getStats() (plugin/Live/Live.php) returns a password-protected transmission's RTMP stream key, its isPasswordProtected flag, and its HLS (m3u8) URL to unauthenticated callers, in both the public applications list an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88876] AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vu…

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/PlayerSkins/seo.php that allows unauthenticated attackers to access password-protected video sources by calling getSources() without password validation. Attackers can request the seo.php endpoint with a video ID to obtain the direct MP4 URL and read protected media bytes witho…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-19439] The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisati…

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-79323] Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (mage…

Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 allows remote unauthenticated attackers to obtain blog commenter email addresses and internal customer and admin identifiers via a POST request to /graphql.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-16960] The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to…

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69805] External control of file name or path in .NET allows an unauthorized attacker to elevate privileges …

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69806] Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to …

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-69549] Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to eleva…

Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Crítico vulnerabilidad

05/09/2026

[CVE-2026-86190] WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns …

WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal d…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18486] IBM ContextForge MCP Gateway <= v1.0.7 MCP Context Forge could allow a remote authenticated attacker…

IBM ContextForge MCP Gateway

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-19300] IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information …

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81270] Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: t…

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-44506] Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1…

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

01/09/2026

Vulnerabilidad alta en Kyverno anterior a 1.16.4 expone tokens de servicio en solicitudes HTTP

Kyverno versiones anteriores a 1.16.4 adjunta automáticamente el token de la ServiceAccount del controlador de admisión a solicitudes HTTP salientes en modo apiCall sin validación explícita de autorización. Un atacante puede exfiltrar este token dirigiendo solicitudes apiCall a servidores externos o controlados, comprometiendo completamente las políticas de Kyverno y los recursos del cluster Kubernetes.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-53553] Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traver…

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability exists in its backend API endpoints, specifically /deploy/fileDiff (File Compare), when handling file paths provided by the client. This issue has been patched in version 1.18.0.

nvdaltovulnerabilidad CVSS 7.7 NVD