Alertas de Seguridad de la Información

M Alto vulnerabilidad

23/09/2026

Vulnerabilidad de Control de Acceso en ManageEngine OpManager y Firewall Analyzer (CVE-2026-84791)

ManageEngine OpManager y Firewall Analyzer versiones 12.8.710 e inferiores contienen una vulnerabilidad de control de acceso deficiente (CVSS 7.1) que permite a usuarios autenticados con privilegios bajos modificar configuraciones de reportes de Change Management en firewalls fuera de su alcance asignado. Esto afecta directamente a empresas en México y LATAM que utilizan estas soluciones para gestión de infraestructura de red y firewall. El riesgo se incrementa en organizaciones con múltiples equipos de operaciones sin segmentación adecuada de permisos.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-91793] When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotatio…

When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-93508] The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-…

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17644] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain un…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-17618] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated at…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-63104] Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authen…

Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to delete and modify tasks beyond their assigned permissions by exploiting the bulk task endpoint that omits workspace permission checks. Attackers can send requests to the PATCH /api/task/bulk endpoint, which verifies only workspace membership w…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-43643] Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerabil…

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and from_billing_module parameters to the admin panel dispatcher. Attackers can send a POST request with arbitrary uid and balance values in the billing_data…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94534] lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/av…

lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fields including nickname, ID card, sex, nation, education, work description, and avatar attachments of other users.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94495] jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemCon…

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system configuration. Attackers can rewrite or delete tenant-wide settings covering company identity, stock rules, approval behavior, and printing configuration through the systemConfig endpoint.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94496] jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authe…

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and access all business records in the tenant.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94497] jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints ac…

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without authorization checks.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-94501] jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints…

jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or delete authorization-relation rows without privilege checks. Attackers can manipulate user-role mappings and access controls to escalate privileges, strip access from other accounts, or modify role-function relationships for any user in the tena…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/09/2026

[CVE-2026-76554] The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an im…

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-17619] IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL …

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93456] django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin…

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-88904] The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST rou…

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92793] GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowi…

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92782] Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allo…

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92776] Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, all…

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92753] PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts…

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated attackers can read platform event history, delete arbitrary events, and modify alerts belonging to other users.

nvdaltovulnerabilidad CVSS 7.1 NVD