Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-107914] Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration ex…

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-102387] Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.

Unauthenticated Sensitive Data Exposure in Xserver Migrator

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38058] The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, i…

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them offline using commodity hardware.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-71330] Exposure of sensitive system information to an unauthorized control sphere in Windows Services for N…

Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80118] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handler writes a crash-dump-format (PAGEDU64) image of all physical memory to a caller-supplied file path in…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-80119] PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics …

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-66840] XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sp…

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/09/2026

Exposición de datos sensibles sin autenticación en WooCommerce Product Attachment ≤ 2.3.3

WooCommerce Product Attachment versión 2.3.3 y anteriores contiene una vulnerabilidad que permite a atacantes acceder a datos sensibles sin requerir autenticación, con puntuación CVSS 7.5. Esta exposición afecta principalmente a tiendas en línea operadas en México y Latinoamérica que utilizan este plugin en WordPress. El riesgo se amplifica en entornos de comercio electrónico que manejan información de clientes, productos o transacciones.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78268] Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat But…

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-32468] Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

16/08/2026

[CVE-2024-58375] OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when u…

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66462] Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-44945] A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests…

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59548] Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking <= 1.0.0 versions.

Unauthenticated Sensitive Data Exposure in Byteflows Travel &amp; Hotel Booking

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59528] Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-28698] Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to a…

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem.

nvdaltovulnerabilidad CVSS 8.6 NVD

H Alto vulnerabilidad

21/07/2026

[CVE-2023-37507] HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus thei…

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

06/07/2026

[CVE-2026-14808] Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerabili…

Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain the database account and password.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-56124] phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allow…

phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hash…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56060] Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 v…

Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD