Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48390] Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escala…

Bridge is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48396] Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code e…

Bridge is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14167] A low privileged remote attacker can perform privileged configuration changes reserved for the admin…

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43672] An authorization issue was addressed with improved state management. This issue is fixed in macOS Se…

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences.

nvdaltovulnerabilidad CVSS 7.1 NVD

J Alto vulnerabilidad

27/07/2026

[CVE-2026-42016] JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation at…

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17568] Improper access control in the role membership management endpoint in Devolutions Server allows an a…

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59689] An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Ob…

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-8789] The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to…

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65596] n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restrict…

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a cr…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65015] n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature whe…

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61325] Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Interna…

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact addition…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60951] Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal O…

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modifica…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60320] Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset…

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to criti…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47697] Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organi…

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org …

nvdaltovulnerabilidad CVSS 7.1 NVD

L Alto vulnerabilidad

21/07/2026

[CVE-2026-59851] A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does no…

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16200] A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in…

A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-10130] QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to…

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16126] A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h…

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem ear…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47866] VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the ne…

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62228] OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that a…

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to persist or execute actions that exceed the caller's approved permissions.

nvdaltovulnerabilidad CVSS 8.8 NVD