Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/07/2026

[CVE-2026-15319] A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function…

A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. This affects the function IPAllowlist of the file web/backend/middleware/access_control.go of the component Launcher. Such manipulation leads to improper access controls. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is 3126. A patch should be applied…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-15271] A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS…

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege violation. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitation …

nvdaltovulnerabilidad CVSS 7.5 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-15270] A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability …

A weakness has been identified in D-link DIR-823G 1.0.2B05_20181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The attack requires a high level of complexity. The exploitation appears to be difficult. The exploit has bee…

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

09/07/2026

[CVE-2026-33390] An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality …

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-14778] A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management…

A security vulnerability has been detected in SourceCodester Onlne Examination & Learning Management System 1.0. This affects an unknown part of the file /ajax_enroll.php of the component Enrollment Management. The manipulation of the argument student_id/schedule_id/action leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed publicly an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14719] A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impa…

A flaw has been found in SourceCodester Onlne Examination & Learning Management System 1.0. The impacted element is an unknown function of the file register.php of the component Registration Endpoint. Executing a manipulation of the argument role can lead to improper privilege management. The attack can be executed remotely. The exploit has been published and may be used. The name of the affected …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14690] A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. …

A weakness has been identified in SourceCodester Multi-Vendor Online Grocery Management System 1.0. This affects the function save_users of the file classes/Users.php. This manipulation causes improper authorization. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

W Alto vulnerabilidad

02/07/2026

[CVE-2026-59093] Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the…

Weaviate before 1.38.0 does not verify that a principal performing an RBAC role assignment holds the permissions granted by the assigned role. The assignRoleToUser and assignRoleToGroup handlers (POST /authz/users/{id}/assign and /authz/groups/{id}/assign) authorize only that the caller may assign roles to the target user or group, not the permissions contained in the assigned roles, unlike role c…

nvdaltovulnerabilidad CVSS 8.8 NVD

R Alto vulnerabilidad

01/07/2026

[CVE-2026-5136] A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignme…

A flaw was found in Foreman. The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member. Successful exploitation of this vulnerability leads to full privilege es…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56247] Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validat…

Capgo before 12.128.2 allows org admins to assign org-scoped RBAC roles at app scope without validating role scope compatibility, including to pending invitees. Attackers can pre-seed malformed high-privilege bindings that survive invite acceptance, enabling accepted low-privilege users to perform unauthorized privileged app actions.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13568] A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability…

A weakness has been identified in SourceCodester Inventory Management System 1.0. This vulnerability affects unknown code of the file /api/users_handler.php of the component User Registration Endpoint. This manipulation of the argument role causes improper access controls. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-22078] Because O+ Connect's IPC service does not authenticate clients, external applications can escalate p…

Because O+ Connect's IPC service does not authenticate clients, external applications can escalate privileges and perform sensitive actions through the IPC channel.

nvdaltovulnerabilidad CVSS 7.3 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49413] The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID …

The Linuxulator determined whether a binary was set-user-ID or set-group-ID by checking the P_SUGID process flag. During execve(2), this flag is not yet set at the point where the auxiliary vector is constructed, so AT_SECURE was incorrectly set to zero for set-user-ID and set-group-ID executables. An unprivileged local user can inject a shared library via LD_PRELOAD into a set-user-ID or set-gr…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56010] Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.

Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56008] Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.

Contributor Privilege Escalation in Fusion Builder

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12786] A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this i…

A vulnerability has been found in Ezbsystems UltraISO Premium Edition up to 9.76. Affected by this issue is some unknown functionality in the library bootpt64.sys of the component Kernel Driver. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12782] A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is a…

A security flaw has been discovered in EaseUS Partition Master up to 14.5. The impacted element is an unknown function in the library EUEDKEPM.sys of the component Kernel Driver. The manipulation results in improper access controls. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The affected component should be upgraded. The vendor ex…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12784] A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown fu…

A weakness has been identified in IM-Magic Partition Resizer up to 7.9.0. This affects an unknown function in the library MDA_NTDRV.sys of the component Kernel Driver. This manipulation causes improper access controls. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not r…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12781] A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unk…

A vulnerability was identified in EaseUS Partition Master up to 14.5. The affected element is an unknown function in the library epmntdrv.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit is publicly available and might be used. You should upgrade the affected component. The vendor explains: "We have confir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

21/06/2026

[CVE-2026-12778] A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affect…

A vulnerability has been found in AOMEI Partition Assistant up to 10.10.1. This vulnerability affects unknown code in the library ampa10.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond…

nvdaltovulnerabilidad CVSS 7.8 NVD