Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/08/2026

[CVE-2026-82657] Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for foru…

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements modules. Unauthenticated attackers can retrieve forum topics and announcements by sending GET requests to rss/forum.php or rss/announcements.php, disclosing titles, full post text, author names, and timestamps.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/08/2026

[CVE-2026-77007] The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perfo…

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55485] Piccolo Admin is an admin interface and content management system for Python, built on top of Piccol…

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is no…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77438] Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.10…

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-81679] OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the …

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a zero-parameter GET request to the notification endpoint to retrieve sensitive notification metadata and …

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77017] The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may s…

The Workeera WordPress plugin before 1.0.6 does not restrict which profile values a candidate may submit, nor confine the stored file location to an allowed directory before serving it, allowing users with a role as low as subscriber to read arbitrary files on the server, including its configuration file and authentication secrets.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-19715] The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access …

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55553] urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other re…

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or dig…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/08/2026

[CVE-2026-59256] WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() …

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restric…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

Vulnerabilidad de control de acceso en Combodo iTop anterior a versión 3.2.3

Combodo iTop, herramienta web de gestión de servicios TI ampliamente usada en empresas latinoamericanas, presenta una falla de control de acceso en OQL (Object Query Language) anterior a la versión 3.2.3. Solo las clases presentes en la cláusula SELECT reciben protección por silos de acceso, permitiendo a usuarios autenticados eludir restricciones y acceder a datos no autorizados. Con CVSS 7.7, este vector afecta principalmente a organizaciones con múltiples departamentos o clientes que dependen del aislamiento de datos en iTop.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-62316] Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-62960] Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server…

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare U…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-30866] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can ac…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-71862] Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime,…

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-17060] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-73137] A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Mana…

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-cont…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76262] In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus servi…

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterprise versions below 10.4. The information disclosure is possible because the Prometheus metrics endpoint …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-75918] phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user …

phpMyFAQ before 4.1.7 stores password reset tokens in a publicly accessible tracking file when user tracking is enabled. Unauthenticated attackers can read the tracking file at content/core/data/trackingDDMMYYYY to extract reset tokens and replay them against the password reset API to take over user accounts.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

18/08/2026

[CVE-2026-62988] Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Cu…

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An aut…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-75915] CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_ex…

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.

nvdaltovulnerabilidad CVSS 7.5 NVD