Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/06/2026

[CVE-2026-49822] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a low-privilege developer who could create a KubernetesWatchTrigger (KWT) in their own namespace was able to establish a persistent surveillance channel over any other namespace. This issue has been patched in version 1.24.0.

nvdaltovulnerabilidad CVSS 7.7 NVD

P Alto vulnerabilidad

10/06/2026

[CVE-2026-46558] Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace …

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces. This issue has been patched in version 1.3.1.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45549] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/') and @jwt_required() only — no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the…

nvdaltovulnerabilidad CVSS 8.5 NVD

Q Alto vulnerabilidad

10/06/2026

[CVE-2026-26237] A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can …

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

10/06/2026

[CVE-2026-46518] OpenEMR is a free and open source electronic health records and medical practice management applicat…

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a clinician's browser session. Patient demographic fields (name, address) are rendered without output encoding i…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-49948] Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability …

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and emb…

nvdaltovulnerabilidad CVSS 8.1 NVD

Q Alto vulnerabilidad

09/06/2026

[CVE-2026-26236] A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can …

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44751] Application server ABAP does not perform necessary authorization checks for an authenticated user al…

Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. This has high impact on integrity with low impact on availability and no impact on confidentiality of the application.

nvdaltovulnerabilidad CVSS 7.1 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46444] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API ke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-5228] Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile …

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10737] The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a…

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links for arbitrary files stored inside project folders on the server, which can contain sensitive informatio…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

02/06/2026

[CVE-2026-31942] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42669] Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Co…

Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-42670] Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservati…

Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2025-53345] Missing Authorization vulnerability leading to code execution after installing malicious vulnerable …

Missing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Core: from n/a through 2.3.3.

nvdaltovulnerabilidad CVSS 8.8 NVD