Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50344] Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.

Improper authorization in Windows OLE allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50346] Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58631] Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally…

Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-49170] Insufficient granularity of access control in Windows StateRepository API allows an authorized attac…

Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56313] Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prel…

Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that allows enterprise administrators to delete password identities of users in foreign organizations. Attackers with org.update_settings permission and an active SSO provider can call the prelink-users endpoint to permanently remove email-based authentication for any user matching the …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56241] Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users …

Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to delete_non_compliant_bundles and count_non_compliant_bundles RPCs due to stale org_users.user_right column not being cleared during role binding deletion. Attackers can exploit this by maintaining a previously granted super_admin role to enumerate and bulk delete non-compliant bundl…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55212] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the…

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definiti…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-56246] Capgo before 12.128.2 contains a broken access control vulnerability in the organization management …

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., …

nvdaltovulnerabilidad CVSS 8.1 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-55428] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGua…

nvdaltovulnerabilidad CVSS 8.2 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55077] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14778] A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management…

A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14753] A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. …

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14690] A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. …

A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58424] Permanent Fork PR Workflow Approval Gate Bypass

Permanent Fork PR Workflow Approval Gate Bypass

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58284] Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute…

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57983] Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass …

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56320] Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a c…

Capgo before 12.128.2 contains an authorization flaw in POST /private/create_device that accepts a caller-supplied org_id parameter without validating it matches the target app's owner organization. Authenticated attackers can create device records for an application using a foreign organization identifier, bypassing the intended org/app authorization boundary.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56249] Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoin…

Capgo before 12.128.2 contains an authorization bypass vulnerability in the channel creation endpoint that allows authenticated users to overwrite existing channels by reusing their names. Attackers with app.create_channel permission can exploit a logic mismatch between existence validation and upsert operations to reassign channel ownership and modify critical production channel configurations.

nvdaltovulnerabilidad CVSS 7.6 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49877] Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console…

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the is…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56231] Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST …

Capgo before 12.128.2 contains a broken object level authorization (BOLA) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. The handlers authorize the request based only on the attacker-controlled app_id supplied in the request body and never verify that the jobId in the URL belongs to that app_id (or the same tenant/org) before issuing privileged builder comma…

nvdaltovulnerabilidad CVSS 7.6 NVD