Alertas de Seguridad de la Información

J Alto vulnerabilidad

07/07/2026

[CVE-2026-48958] An improper access check allows unauthorized users to create custom fields via webservices endpoints…

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

nvdaltovulnerabilidad CVSS 8.8 NVD

J Alto vulnerabilidad

07/07/2026

[CVE-2026-48948] An improper access check allows user to download vcard exports of com_contact contacts that are inac…

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

nvdaltovulnerabilidad CVSS 8.8 NVD

T Alto vulnerabilidad

06/07/2026

[CVE-2026-54765] Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik…

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef f…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-9085] Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBI…

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14736] A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown f…

A vulnerability was found in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71380] The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host…

The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compromised credentials can exploit this node to run malicious commands, potentially leading to data exfiltration, service disruption, or complete system compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58421] Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58286] Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor…

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58282] Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfor…

Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27779] Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting publ…

Gitea versions before 1.25.5 accept malformed or injected forwarded-proto values when detecting public URLs, allowing spoofed canonical URL generation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28699] Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed…

Gitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypassed through HTTP Basic authentication.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27660] Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the requ…

Gitea versions before 1.25.5 allow draft release data or attachments to be accessed without the required write permission.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-22555] Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first…

Gitea versions before 1.26.0 allow API users to fork a repository into an organization without first passing the CanCreateOrgRepo check, which can expose organization secrets.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-24451] Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public t…

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-24690] Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull reque…

Gitea versions before 1.25.5 have insufficient permission checks for updating or rebasing pull request branches.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-25712] Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for…

Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.

nvdaltovulnerabilidad CVSS 7.5 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55112] A malicious actor with access to the network and low privileges and under certain conditions could e…

A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi Protect Application to escalate privileges on the host device.

nvdaltovulnerabilidad CVSS 7.5 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55114] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

nvdaltovulnerabilidad CVSS 8.8 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55118] A malicious actor with access to the network,low privileges and under certain conditions could explo…

A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Network Application to escalate privileges within the UniFi Network Application.

nvdaltovulnerabilidad CVSS 8.3 NVD

U Alto vulnerabilidad

02/07/2026

[CVE-2026-55119] A malicious actor with access to the network and low privileges could exploit an Improper Access Con…

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Talk Application to escalate privileges within the UniFi Talk Application.

nvdaltovulnerabilidad CVSS 8.1 NVD