Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-58562] Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A…

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76223] ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission che…

ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScri…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-73394] Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

Unauthenticated Broken Access Control in Stitch Express

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-73385] Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Unauthenticated Broken Access Control in Outranking Plugin Options

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-71307] Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/desti…

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting sensitive values. The sftp-destination plugin stored password and privateKeyPass values in plaintext, allow…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-71308] Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit…

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-67262] Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped …

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73994] Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Unauthenticated Broken Access Control in Charitable

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73377] Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-73356] Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Unauthenticated Arbitrary Content Deletion in Breeze

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-69189] Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.use…

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history ide…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32549] Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-32472] Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Unauthenticated Broken Access Control in Online Contact Widget

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-28567] Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

Unauthenticated Broken Access Control in WP Sort Order

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-28571] Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Unauthenticated Broken Access Control in FormyChat

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad de autorización en ArcadeDB versiones ≤26.7.3 permite eliminación no autorizada de funciones

ArcadeDB antes de la versión 26.8.1 contiene una falla de autorización que permite a cualquier usuario con acceso a la base de datos ejecutar DELETE FUNCTION sin validación de permisos. Un atacante puede eliminar funciones del servidor comprometiendo la integridad de aplicaciones que dependen de ArcadeDB en infraestructuras altas de LATAM. La vulnerabilidad (CVSS 7.1) afecta principalmente a bases de datos expuestas internamente o en entornos multi-tenant.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad alta en ArcadeDB: falla de autorización en plugin Gremlin (CVE-2026-75853)

El plugin Gremlin de ArcadeDB versiones ≤26.7.3 autentica conexiones pero no valida permisos de acceso a bases de datos, permitiendo que credenciales válidas accedan a cualquier base de datos sin autorización. Esto afecta directamente a empresas con infraestructuras de bases de datos distribuidas en LATAM que dependen del control granular de accesos. La vulnerabilidad tiene puntuación CVSS 8.8, indicando impacto alta en confidencialidad e integridad de datos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

Vulnerabilidad alta de autorización en Plugin API de Grav (CVE-2026-75836)

El plugin API de Grav anterior a versión 1.0.14 presenta una falla en la validación de autorización en el endpoint POST /api/v1/menubar/actions/{plugin}/{action}, permitiendo a usuarios autenticados ejecutar acciones administrativas sin permisos explícitos. La vulnerabilidad afecta principalmente a instancias de Grav con admin-next/API stack expuestas en entornos de producción. Con CVSS 8.8, representa un riesgo alta para sitios web y portales corporativos en LATAM que utilizan este CMS.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-74904] SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kerne…

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-11801] The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all…

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including register…

nvdaltovulnerabilidad CVSS 7.5 NVD