Alertas de Seguridad de la Información

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18788] A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted eleme…

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-59912] Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Ac…

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-62246] Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a Te…

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or dest…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-58043] A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree pr…

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16527] An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP…

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-65943] Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62427] [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing …

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64737] An authorization issue was addressed with improved state management. This issue is fixed in macOS Se…

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43760] An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma…

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-28945] A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS…

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14235] The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to th…

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-9765] Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. …

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attac…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-14603] The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorizatio…

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-35425] Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code…

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65757] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules An…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64876] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP ext…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2024-58330] A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthentic…

A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63684] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various ad…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-63685] Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator r…

Joomla Extension - regularlabs.com - Authorization bypass in DB Replacer extension - Administrator routes and replacement requests did not consistently require Super User permission and a valid token. An unauthorized backend user or CSRF attack could perform database replacements, potentially causing major data corruption or site compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD