Alertas de Seguridad de la Información

M Crítico vulnerabilidad Nuevo

Ahora mismo

Escalada de privilegios sin autenticación en Jawn <= 1.4.2 (CVSS 9.8)

Se ha identificado una vulnerabilidad crítica de escalada de privilegios sin autenticación en Jawn versión 1.4.2 y anteriores, con puntuación CVSS 9.8. Un atacante remoto puede explotar esta falla para obtener acceso administrativo sin credenciales válidas. Empresas en México y LATAM que utilicen Jawn en producción enfrentan riesgo inmediato de compromiso total del sistema.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-32558] Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPres…

Unauthenticated Privilege Escalation in Affiliate Pro - Affiliate Program for WooCommerce & WordPress

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-28165] Unauthenticated Privilege Escalation in Digits <= 9.2 versions.

Unauthenticated Privilege Escalation in Digits

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

Escalada de Privilegios sin Autenticación en Abandoned Cart Pro para WooCommerce ≤ 10.4.0

Se identificó una vulnerabilidad crítica (CVSS 9.8) de escalada de privilegios sin autenticación en el plugin Abandoned Cart Pro para WooCommerce en versiones 10.4.0 y anteriores. Esta falla permite a atacantes remotos obtener acceso administrativo en tiendas WooCommerce sin credenciales válidas. Afecta especialmente a pequeñas y medianas empresas en LATAM que operan plataformas de e-commerce sin parchear regularmente sus plugins.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2025-15689] Unauthenticated Privilege Escalation in Capella <= 2.5.5 versions.

Unauthenticated Privilege Escalation in Capella

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-11861] A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Dire…

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certifi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-73390] Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.

Unauthenticated Privilege Escalation in Total Donations

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-73347] Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.

Unauthenticated Privilege Escalation in TrueBooker

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73350] Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

Unauthenticated Broken Authentication in SupportCandy

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-28191] Subscriber Privilege Escalation in The Grid <= 2.7.9.1 versions.

Subscriber Privilege Escalation in The Grid

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-15218] A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. Th…

A flaw was found in the maas-api and maas-controller ServiceAccounts within Red Hat OpenShift AI. These ServiceAccounts are granted cluster-wide permissions that exceed their operational requirements. An attacker who compromises the identity of these ServiceAccounts, either through a remote code execution vulnerability or by creating a malicious pod in the same namespace, could exploit these exces…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite escalación de privilegios

El plugin getgrav/grav-plugin-api anterior a la versión 1.0.13 no valida correctamente que los permisos de nuevas claves API sean un subconjunto de los permisos del solicitante. Un atacante con una clave API de bajo privilegio puede crear claves con permisos elevados, comprometiendo aplicaciones Grav alojadas en México y Latinoamérica. Esta vulnerabilidad afecta directamente portales de contenido, sistemas de gestión documental y plataformas educativas que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72839] filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is ena…

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72840] OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants writ…

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66661] Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.

Subscriber Privilege Escalation in Directories Pro

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-66424] Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-61979] Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

Unauthenticated Privilege Escalation in SAML SP Single Sign On

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28161] Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Subscriber Privilege Escalation in Service Finder Booking

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-27543] Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Unauthenticated Privilege Escalation in MStore API

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-18621] A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can b…

A flaw was found in Data Science Pipelines (DSP). An attacker with namespace editor privileges can bypass security hardening by submitting a malicious Argo Workflow through the V1 API path. This allows the API server to create pods with elevated privileges, acting as a 'confused deputy' on behalf of the attacker. Successful exploitation grants the attacker node-root access, enabling arbitrary code…

nvdaltovulnerabilidad CVSS 7.6 NVD