Alertas de Seguridad de la Información

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta de inyección NoSQL en Budibase anterior a 3.40.0

Budibase versiones anteriores a 3.40.0 contiene una vulnerabilidad de inyección NoSQL en su integración con MongoDB que permite a atacantes inyectar operadores MongoDB a través de parámetros de consulta, eludiendo controles de acceso por usuario. Los atacantes pueden leer documentos arbitrarios, ejecutar JavaScript malicioso y modificar datos en bases de datos MongoDB conectadas. Esta vulnerabilidad afecta principalmente a empresas en LATAM que utilizan Budibase para desarrollo de aplicaciones internas y plataformas de datos sin validación de entrada robusta.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

Inyección NoSQL alta en Budibase Server anterior a v3.40.0 afecta consultas MongoDB

Budibase Server versiones anteriores a 3.40.0 contienen una vulnerabilidad de inyección NoSQL en el endpoint de ejecución de consultas MongoDB. Atacantes con permisos de escritura de consultas pueden manipular parámetros JSON sin sanitizar, alterando queries para leer, modificar o eliminar documentos arbitrarios. El riesgo es alta (CVSS 8.3) en entornos que exponen esta funcionalidad a usuarios no confiables o integran Budibase en plataformas empresariales en LATAM.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad de autorización faltante en SiYuan v3.7.3 y anteriores (CVE-2026-73608)

SiYuan contiene una vulnerabilidad de autorización ausente en el endpoint /api/av/getAttributeViewSearchTarget que permite acceso no autorizado a vistas de atributos sin validación de permisos. La falla afecta la rama de desarrollo y versiones previas a v3.7.4. Organizaciones que utilizan SiYuan para gestión de bases de datos están expuestas a exfiltración de información sensible si acceden versiones vulnerables.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

Vulnerabilidad alta en ManageEngine Password Manager Pro y PAM360 permite eludir autenticación

ManageEngine Password Manager Pro (versiones anteriores a 13232) y PAM360 (versiones anteriores a 8551) presentan una vulnerabilidad de elusión de autenticación (CVSS 8.8) por validación incorrecta de SAML. Esto permite a atacantes acceder a gestores de credenciales sin autenticación válida, comprometiendo todas las contraseñas almacenadas en la solución. Afecta principalmente a empresas medianas y grandes en México y LATAM que utilizan estas herramientas para administración centralizada de accesos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

Vulnerabilidad crítica de autenticación impropia (CVE-2026-59500) afecta múltiples productos

Se ha identificado una vulnerabilidad de severidad crítica (CVSS 10.0) en mecanismos de autenticación de múltiples fabricantes, permitiendo a atacantes eludir controles de acceso sin credenciales válidas. Esta falla afecta directamente infraestructuras críticas en México y Latinoamérica que dependen de sistemas de identificación y acceso. El impacto abarca compromisos totales de confidencialidad, integridad y disponibilidad en sistemas afectados.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-59503] CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Per…

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-59507] CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized…

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59499] CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-19484] @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthent…

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-15413] The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it …

The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check).

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18146] The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo…

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18945] The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its…

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-49473] @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Ce…

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issue where, under certain circumstances, the middleware matches incoming requests against Cedar action map…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-49481] UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability …

UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vulnerability in the UpSnap’s device management functionality due to the presence of unsafe shell command template interpolation using the ip and the mac fields. User-controlled values can be inserted into the wake_cmd and shutdown_cmd templates and executed via /bin/sh -c (Linux) or cmd /C (Windows) without sani…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-47717] FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3…

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73519] WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every buil…

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management po…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-71473] A flaw was found in the `search-v2-operator` component. A user with specific administrative permissi…

A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings, leading to the replacement of container images. This ultimately results in container image injection on the managed cluster, potentially com…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73495] blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0…

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-73498] MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira).…

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in src/mcp_atlassian/confluence/attachments.py through _upload_attachment_direct() without calling validate_safe_path. An authenticated MCP client can read any file accessible to the…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-71469] A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests …

A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead to memory exhaustion of the search-api pod, resulting in a Denial of Service (DoS).

nvdaltovulnerabilidad CVSS 7.5 NVD