Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/08/2026

Vulnerabilidad alta de evasión de autorización en WP Travel Engine (CVE-2026-17087)

El plugin WP Travel Engine para WordPress (versiones ≤6.8.4) permite a atacantes no autenticados acceder a datos privados de reservas y facturación de clientes mediante evasión de controles de autorización. Esta vulnerabilidad afecta directamente a agencias de viajes, operadores turísticos y plataformas de booking en LATAM que utilizan este plugin para gestionar reservaciones y pagos.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16772] In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to …

In Akaunting versions sync()` call without verifying whether the caller is authorized to manage roles. …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

Plugin Grav API: bypas de restricción de scopes en endpoint de reportes (CVE-2026-72825)

El plugin getgrav/grav-plugin-api anterior a versión 1.0.13 contiene una vulnerabilidad que permite eludir las restricciones de scope de API keys. Un atacante con credenciales de API limitadas puede ejecutar operaciones de configuración a nivel administrador en el endpoint POST /reports/twig-content/allowlist, comprometiendo la integridad de sistemas Grav en producción. Afecta especialmente a plataformas de contenido desplegadas en México y LATAM que exponen APIs internas.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-72810] SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast…

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73658] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResourc…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73305] Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal…

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72675] Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unautho…

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning fu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72665] Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic …

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live que…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72669] The state that Kibana stores for an Observability Onboarding flow is not bound to the user who creat…

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59714] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 bef…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_chann…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66469] Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

Unauthenticated Broken Access Control in Arvow AI SEO Writer

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66461] Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66466] Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Up…

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66431] Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLIN…

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66441] Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

Unauthenticated Broken Access Control in MultiVendorX

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-61984] Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

Unauthenticated Broken Access Control in WPMobile.App

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28186] Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Subscriber Broken Access Control in Travelfic Toolkit

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28188] Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Unauthenticated Broken Access Control in Hydra Booking

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28173] Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

Customer Arbitrary Content Deletion in WP Event SOlution

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-27535] Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Subscriber Broken Access Control in Solace Extra

nvdaltovulnerabilidad CVSS 7.1 NVD