Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/09/2026

Vulnerabilidad alta en Menulux Portal: almacenamiento de contraseñas en texto plano

Menulux Portal anterior a versión 20260903211448 almacena contraseñas en texto plano, permitiendo a atacantes acceder a credenciales sensibles si comprometen el servidor o la base de datos. Esta vulnerabilidad afecta directamente a restaurantes, bares y comercios que utilizan este sistema POS en México y Latinoamérica. El riesgo es alta para operaciones que manejan datos de clientes y empleados.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

Vulnerabilidad de discrepancia de respuesta en Menulux Portal permite suplantación de cuentas

Se ha identificado una vulnerabilidad de tipo Observable Response Discrepancy (CVE-2026-19080, CVSS 7.5) en Menulux Portal que permite a atacantes realizar footprinting de cuentas de usuario explotando diferencias detectables en las respuestas del servidor. Esta debilidad afecta versiones anteriores a 20260903211448 y representa un riesgo moderado-alto para restaurantes, cafeterías y establecimientos gastronómicos en LATAM que utilicen esta plataforma de gestión.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

Vulnerabilidad en Fastify anterior a v5.12.2 por validación incompleta de encabezados HTTP

Fastify versiones anteriores a 5.12.2 presentan una validación incompleta de encabezados HTTP case-insensitive en esquemas de rutas. La transformación de minúsculas no se aplica correctamente en dependencias JSON Schema Draft 7, permitiendo que propiedades no normalizadas en el esquema causen comportamiento inesperado o bypass de validaciones. Esto afecta a aplicaciones Node.js en producción que dependen de validación estricta de encabezados para autenticación, autorización o filtrado de solicitudes.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85512] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vu…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85540] DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers …

DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-82923] The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or n…

The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated attackers to install and activate plugins and themes, import content from a URL under their control, write a file of their choosing into the uploads directory, and delete site content and media. On a host that serves PHP from the uploads di…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84469] fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthi…

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to deny all input, fastify treats it as a missing schema, compiles no validator, and runs the route handl…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-84504] fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the …

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that property's value before the handler runs, so the handler receives a different object than the one that s…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85184] @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by m…

@fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request target to its path before dispatching. Because the two layers evaluate different strings, a request using an absolute-form target reaches the route handler while the path-scoped middleware, such as aut…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-76169] fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix t…

fastify versions >= 4.0.0 and before 5.12.2 can route a malformed URL sent under one plugin prefix to the custom not-found handler of a different sibling plugin, and invoke it without the preHandler hook declared for that handler. The internal not-found router for encapsulated handlers dispatches malformed paths through a single shared handler pointer before URL decoding, ignoring the prefix and s…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81302] PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a loc…

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81665] A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembl…

A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85525] Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a r…

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage ho…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-57777] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85197] A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can ex…

A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in informat…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-85085] The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView…

The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85094] The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin ru…

The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-81270] Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: t…

Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-62928] XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injec…

XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-66840] XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sp…

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

nvdaltovulnerabilidad CVSS 7.5 NVD