Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-78245] A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_upl…

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad Nuevo

Ahora mismo

[CVE-2026-78202] A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_setting…

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-55622] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new project. This issue could allow an attacker to access secrets in instances they are not authorized to access.…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-55621] Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorizati…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume to a new project. This issue could allow an attacker to access secrets in custom volumes they are not au…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-16576] The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 d…

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14-installation capability, allowing users such as Shop Man…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-66309] Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges ov…

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-66788] A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vu…

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76313] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the…

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution (RCE) by uploading a malicious knowledge bundle and causing it to be used by distributed search, which can allow for access to all relevant data and affect system integrity and availability. The vulnerability is possible because th…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-76310] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the associated search job dispatch archive, recover session material, and use it to access all relevant data available to the report owner and affect system integrity, including by performing administrative actions when the owner holds the "admin" Splunk r…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-76311] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has an embedded report token could download the dispatch archive for an embedded report search job and use exposed session material to access all relevant data and affect system integrity on the Splunk platform instance. The vulnerability is possible because the embedded report authorization flow do…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-76312] In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who can read the Hypertext Markup Language (HTML) source of a page that embeds a Splunk report could use exposed session material to access all relevant data and affect system integrity. The vulnerability is possible because the dispatch archive download path does not correctly enforce the embedded-repo…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-20315] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Wo…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20315 are related to improper access control issues that are …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-18776] The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of i…

The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the email address of arbitrary users, including administrators, and subsequently take over their account via the password reset flow.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-13174] The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting …

The Eventin WordPress plugin before 4.1.21 does not verify ownership or capability before deleting user accounts, allowing users with contributor-level access and above to permanently delete other users' accounts.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-66780] A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, whi…

A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information. Consequently, an attacker can redirect inter-cluster tunnel traffic, enabling a Man-in-the-Middle (…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-50138] goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with Web…

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port. The WebDAV port is wired straight to `golang.org/x/net/webdav.Handler` with no equivalent guard, so an authenticated WebDAV client can `PUT`, `DELETE`, `MKCOL`…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-74979] Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Fir…

Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

16/08/2026

[CVE-2026-73061] Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that al…

Scriban before 7.2.2 contains an access-modifier bypass vulnerability in TypedObjectAccessor that allows template code to write CLR object properties without setter-visibility checks. Attackers can modify properties with private, internal, or init-only setters, and perform mass assignment on public-setter properties, permanently altering live host objects after template rendering.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad alta en File Browser permite acceso no autorizado a archivos de otros usuarios

File Browser versiones anteriores a 2.63.20 contiene una falla de aislamiento en los mecanismos de autenticación por proxy y auto-aprovisionamiento de usuarios. Atacantes con credenciales válidas pueden leer, modificar, eliminar y compartir archivos de otros usuarios al explotar la asignación del scope raíz del servidor. Esta vulnerabilidad afecta especialmente a organizaciones en LATAM que despliegan File Browser en entornos multi-usuario o en arquitecturas de proxy.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59501] CWE-284: Improper Access Control

CWE-284: Improper Access Control

nvdaltovulnerabilidad CVSS 8.2 NVD