Alertas de Seguridad de la Información

M Alto vulnerabilidad

30/07/2026

[CVE-2026-54367] CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated …

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the static shared encryption key to forge identifiers for any user GUID, including the system-wide cluster …

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-47858] Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes t…

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-5057] ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability a…

ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RpcProvider class. The issue results from the lack of authentication prior to allowing access to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14976] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code exec…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-16771] In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑sid…

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagno…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-7187] Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Ac…

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-63765] Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads control…

Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60373] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60439] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-61246] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-65319] Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allow…

Feedbin (commit 739884a) contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterate sequential integer entry IDs through the GET /api/v2/entries/:id/text endpoint to enumerate and ext…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62547] Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notific…

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successful attacks of this vulnerability can result in takeover of Oracle Workflow. CVSS 3.1 Base S…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62534] Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: We…

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities). Supported versions that are affected are 12.2.11-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in takeover of Oracle Applications F…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62493] Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Opera…

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.11-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Scor…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62496] Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal …

Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Yard Management. Successful attacks of this vulnerability can result in takeover of Oracle Yard Management. CVSS 3…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62498] Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Intern…

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturin…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62478] Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: …

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Financials. Successful attacks of this vulnerability can result in takeover of Oracle Publi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62476] Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Int…

Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Public Sect…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-62447] Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LO…

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management. Successful attacks of this vulnerability can result in takeover of Oracle Trade Management. CVSS 3.1 Base…

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-62464] Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operatio…

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confi…

nvdaltovulnerabilidad CVSS 8.8 NVD