Alertas de Seguridad de la Información

M Alto vulnerabilidad

15/09/2026

[CVE-2026-11934] IBM Verify Identity Access could allow an administrator to execute additional commands they are not …

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-45048] Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHan…

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session management endpoint does not enforce ownership or privilege checks when a low-privileged authenticated user queries session information in deployments using stateful session storage. A requester who knows a target identity identifier can retrieve another user's active session cre…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90858] A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07e…

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function session_start of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The attack may be launched remotely. The exploit has been published and may be used. This product operates…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54178] backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of …

backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 6.8.12 and 7.0.35, HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php trusts disk-relative paths from clear_[] and passes them to Storage::disk()->delete without confirming t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90566] A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5…

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-80436] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a d…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service by deleting arbitrary RabbitMQ queues or exchanges due to improper authorization.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-80378] IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a d…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper authorization.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58611] Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges l…

Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

Bypass de autorización alta en SourceCodester Syllabus-Aligned LMS 1.0 (CVE-2026-86277)

Se ha identificado una vulnerabilidad de bypass de autorización en SourceCodester Syllabus-Aligned Learning Management & Examination System versión 1.0, específicamente en el archivo delete_exam.php. Un atacante remoto puede manipular el parámetro ID para eludir controles de acceso y eliminar exámenes sin autorización. La vulnerabilidad con CVSS 7.3 afecta instituciones educativas en LATAM que utilizan este LMS para gestión académica y evaluaciones.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86263] A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. …

A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ID results in authorization bypass. The attack may be performed from remote. The exploit is now publi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86261] A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8…

A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument userIdenf can lead to authorization bypass. The attack can be executed remotely. The exploit has been made …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86262] A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d6…

A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/updateOrderdiseaseInfo of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Handler. The manipulation of the argument userID/id leads to authorization bypass. The attack is possible to be carried out rem…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-85638] A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/us…

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/09/2026

[CVE-2026-18175] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due t…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to manipulate database transactions due to improper authorization in the DDM target dispatcher.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85378] A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601…

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is pub…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85105] A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _s…

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82621] A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4c…

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55065] Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api…

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the p…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-78236] An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a…

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55571] djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redi…

nvdaltovulnerabilidad CVSS 8.2 NVD