Alertas de Seguridad de la Información

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta de takeover de cuenta en better-auth 1.1.3 a 1.6.22

better-auth versiones 1.1.3 a 1.6.22 (y pre-lanzamientos 1.7.0-beta.0 a 1.7.0-beta.10) permiten a atacantes secuestrar cuentas de usuarios mediante pre-hijacking de cuenta en flujos de magic-link y email-OTP cuando el registro abierto de email/contraseña está habilitado. Un atacante registra una cuenta con el correo de la víctima sin verificar, luego intercepta el enlace de verificación para tomar control total. Afecta principalmente a aplicaciones web y SaaS en México y LATAM con autenticación sin contraseña.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-14830] The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout …

The FlxWoo WordPress plugin before 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid, allowing unauthenticated attackers to complete WooCommerce orders without paying.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-12695] The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password …

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15240] The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching…

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowing a lower-privileged account that an operator is currently switched into to be resolved as that operator and to switch into any permitted account, including an administrator, resulting in full account takeover.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-13690] The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider i…

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-14300] The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin befor…

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they contro…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-54635] pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON…

pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so se…

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

27/07/2026

[CVE-2026-66014] JFrog Artifactory contains an authentication handling weakness in internal request processing that, …

JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-9830] The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its…

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other users' bookings.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-12255] The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site…

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-12493] The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify …

The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained f…

nvdaltovulnerabilidad CVSS 7.5 NVD

P Alto vulnerabilidad

23/07/2026

[CVE-2026-10697] Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transf…

Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-14291] The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication f…

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ship…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62547] Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notific…

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base S…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62534] Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: We…

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications F…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62493] Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Opera…

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Scor…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62496] Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal …

Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62498] Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Intern…

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturin…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62478] Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: …

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Publi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62476] Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Int…

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sect…

nvdaltovulnerabilidad CVSS 8.8 NVD