Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81202] A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function creat…

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete of the file ajax.php of the component CRUD Operation Handler. Executing a manipulation of the argument action can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-79938] Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnera…

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-78236] An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to a…

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-19718] The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin Word…

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing att…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80192] @better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 …

@better-auth/sso before 1.6.27 (and before 1.4.8 in the 1.4.x line and before 1.7.0-rc.5 in the 1.7 prerelease line) contains two domain-ownership flaws. When domain verification is disabled, automatic organization assignment accepts unverified provider domains, allowing an authenticated organization owner/administrator to register an SSO provider for an arbitrary domain and have users with matchi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-24170] NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where a…

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-55533] PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows …

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, create_auth_middleware() allows requests when auth=api-key lacks PRAISONAI_API_KEY or JWT authentication lacks PRAISONAI_JWT_SECRET. An externally bound Recipe server can therefore accept unauthenticated POST /v1/recipes/run requests despite authentication being enabled. This issue is fixed in version 4.6.58.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-77567] Filament is a collection of full-stack components for accelerated Laravel development. Prior to vers…

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78154] A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function…

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the pro…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-46355] BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebu…

BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting b…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-17000] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76338] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who …

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user who has access to a trusted distributed search private key could forge an administrative session token, access all relevant data, affect system integrity, and disrupt service availability. The vulnerability is possible because the distributed search authentication token endpoint does not require a signe…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16857] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network tr…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to manipulate network traffic and DNS configuration due to improper authentication.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62669] Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Gra…

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task checks only that the pending-session user exists rather than requiring $user->authorized. After submitting a victim's correct password, an attacker can invoke taskRegenerate2FASecret() during the pending TOTP challenge, overwrite twofa_secret, read the r…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-16686] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported f…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to access NFS-exported filesystems due to improper authentication.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-19842] The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML respo…

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-53958] 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an au…

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id. The whitelist in server/api/controllers/users/update.js mass assigns these backend-managed identity att…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-50191] 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerabl…

4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured. The POST /api/register endpoint permits creation of an unverified local account with a victim's email address, and POST /api/…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-52793] Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path i…

Froxlor is open source server administration software. Prior to 2.3.7, the API authentication path in lib/Froxlor/Api/FroxlorRPC.php and FroxlorRPC::validateAuth accepts an API key and secret for an administrator or customer account without checking type_2fa, validating a TOTP code, or invoking FroxlorTwoFactorAuth. The web interface requires a second factor for accounts with two-factor authentica…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-44472] Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account ac…

Saleor is an e-commerce platform. From 2.10.0rc1 until 3.21.67, 3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can use accountRegister to create an account with a victim's email address before the victim registers. If the victim fo…

nvdaltovulnerabilidad CVSS 8.1 NVD