Alertas de Seguridad de la Información

M Alto vulnerabilidad

02/07/2026

[CVE-2026-13125] GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is…

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. In order to access the websocket …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56286] Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoi…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58375] JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the…

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate S…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13546] A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the f…

A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50136] Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an una…

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a wo…

nvdaltovulnerabilidad CVSS 7.4 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-13325] A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set…

A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12490] When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a…

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-1840] The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of …

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without restriction. Such unauthorized changes can disrupt normal functionality and, if performed repeatedly, m…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

24/06/2026

[CVE-2026-56270] Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability i…

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Googl…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

23/06/2026

[CVE-2026-54317] Home Assistant is open source home automation software that puts local control and privacy first. Pr…

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configura…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-13007] Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose…

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10711] Missing authentication for critical function vulnerability in AKIN Software Computer Import Export I…

Missing authentication for critical function vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. CafePlus allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CafePlus: from 12.05.03 before 12.05.04.

nvdaltovulnerabilidad CVSS 8.8 NVD

L Alto vulnerabilidad

21/06/2026

[CVE-2026-12795] A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps…

A vulnerability was determined in BerriAI litellm up to 1.82.2. This affects the function json.dumps of the file litellm/proxy/management_endpoints/ui_sso.py of the component SSO Debug Flow. Executing a manipulation can lead to missing authentication. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-53869] Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows…

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.

nvdaltovulnerabilidad CVSS 7.5 NVD

R Alto vulnerabilidad

17/06/2026

[CVE-2026-30799] Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plu…

Missing Authentication for Critical Function vulnerability in RTI Connext Professional (Security Plugins) allows Identity Spoofing.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.*, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*.

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

17/06/2026

[CVE-2026-35065] Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critica…

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-12199] A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown…

A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (`/SHUTDOWN%20THE%20SERVER`) to terminate the process immediately via `os._exit(0)`. This results in a denial of service, impacting se…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46972] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46973] Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suit…

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outsourced Mfg for Discrete Industries. Successful attacks of this vulnerability can result…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/06/2026

[CVE-2026-46959] Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Inte…

Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Subledger Accounting. Successful attacks of this vulnerability can result in takeover of Oracle Subledger A…

nvdaltovulnerabilidad CVSS 7.5 NVD