Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12722] Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerc…

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54365] CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll…

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints t…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54367] CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated …

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-44100] The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points.…

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-44101] Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker…

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-44090] Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which …

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-47858] Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes t…

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5057] ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability a…

ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-67426] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the stand…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes unauthenticated POST /run on 0.0.0.0:8344 and uses client-supplied callback_url for an outbound POST with X-Internal-Key: $FLYTO_RUNNER_SECRET while bypassing target_allowed, allowing unauthenticated SSRF and runner secret …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-14529] IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature (sipServlet-1.1) is enabled.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-60112] AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that…

AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by calling Sessions.create() without any credential check. Attackers can exploit the unauthenticated session issuance in Sessions.create() and subsequently invoke handle_cmd() to forward ar…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-60113] AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing au…

AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network attackers to access seven unprotected API routes by sending direct HTTP requests with no credentials. Attackers can reach the exposed SLE endpoints to start or stop Deep Space Network c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-62325] goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2…

goshs is a feature-rich single-binary file server for red teamers and developers. From 2.1.3 until 2.1.4, the sftpserver/sftpserver.go password handler used Username != "" && Password != "", so running goshs with -b 'admin:' -sftp and no -fkf left both SFTP authentication handlers unset and allowed unauthenticated file access. This issue is fixed in version 2.1.4.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14976] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code exec…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-14446] IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escal…

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-16771] In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑sid…

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagno…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-7187] Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Ac…

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56163] Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unautho…

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-63765] Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads control…

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

nvdaltovulnerabilidad CVSS 8.2 NVD

J Crítico vulnerabilidad

23/07/2026

[CVE-2026-64812] In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Devel…

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

nvdcriticovulnerabilidad CVSS 10.0 NVD