Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18990] A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file…

A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-69111] Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that all…

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint, which bypasses REST API authentication middleware, by supplying a 'role' parameter to shut down the proxy…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-8446] IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Co…

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth .

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Eclipse Theia 1.73.1 expone acceso no autorizado a archivos del servidor

Eclipse Theia versiones hasta 1.73.1 contienen una vulnerabilidad que permite a atacantes descargar archivos arbitrarios del servidor sin restricción de directorio workspace. El backend `@theia/filesystem` no valida correctamente las rutas URI en endpoints HTTP, afectando especialmente despliegues en navegador donde la validación de tokens es insuficiente. Empresas LATAM usando Theia como IDE en la nube corren riesgo de exposición de fuentes, configuraciones sensibles y datos de negocio.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Book-Management-System: endpoints Flask exponen datos de estudiantes sin autenticación

Los endpoints /student, /record, /books, /find_stu_book y /find_not_return_book carecen del decorador @login_required, permitiendo acceso no autenticado a información personal de estudiantes (nombre, género, estado de carné, deuda) e historial completo de préstamos mediante suministro de card_id. Afecta instituciones educativas y bibliotecas en LATAM que utilizan este sistema de gestión.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-25703] NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to m…

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data containing sensitive information.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18810] A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of …

A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24079] Cryptographic Issue while processing registration requests with malformed or missing authentication …

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-59913] Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Auth…

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-67610] OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client…

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA keypair via the jwks field. Once an administrator approves the registered client, attackers can use the client_credentials grant with a self-sig…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-69091] Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when confi…

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by directly accessing the module with read-only parameters.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/08/2026

[CVE-2026-68578] ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, …

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-65310] ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes …

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12562] The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug int…

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that power…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-15978] SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang…

SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-28814] Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows …

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-67349] OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded …

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-12722] Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerc…

Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54365] CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll…

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious StorageConfigure parameter to the jsonimportuserbyupn, jsonimportuserbyupnex, or japiimportuserbyupn endpoints t…

nvdaltovulnerabilidad CVSS 7.5 NVD