Alertas de Seguridad de la Información

WP Cafe Pro versiones anteriores a 3.0.15 contienen una vulnerabilidad que permite el acceso a datos sensibles sin requerir autenticación. Afecta principalmente a sitios WordPress de cafeterías, restaurantes y negocios similares en LATAM que utilizan este plugin para gestionar menús, pedidos y configuraciones. Con CVSS 7.5, esta vulnerabilidad expone información alta del negocio y datos de clientes.

Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7

Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7

Unauthenticated Sensitive Data Exposure in iCARRY

Unauthenticated Sensitive Data Exposure in REST API Log

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

Subscriber Sensitive Data Exposure in Vimeo

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access controls on internal request handling.

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.…

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to…