Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

[CVE-2026-16041] The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership …

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70636] Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated at…

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-67621] Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated works…

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, con…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18277] Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 2…

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66712] Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

Unauthenticated Broken Access Control in Simple Membership

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66708] Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

Unauthenticated Broken Access Control in Total Upkeep

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66470] Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

Subscriber Broken Access Control in Frontend Admin by DynamiApps

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65554] Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65541] Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

Unauthenticated Broken Access Control in Staff Training

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65504] Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-28140] Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

Unauthenticated Broken Access Control in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65551] Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Ac…

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

Vulnerabilidad de autorización faltante en TinyAGI 0.0.20 permite acceso remoto no autorizado

Se ha detectado una vulnerabilidad de seguridad en TinyAGI versión 0.0.20 que afecta la función processMessage del componente Message API Endpoint. La falla permite eludir controles de autorización y ejecutar acciones remotas sin validación de permisos. El exploit ha sido divulgado públicamente, aumentando el riesgo de explotación inmediata en entornos de producción en Latinoamérica que utilicen esta versión.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-16734] The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the call…

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-15991] The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f…

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrary files on the server, which can lead to remote code execution when the right file is deleted (such as …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71316] Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:n…

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70617] Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any…

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler to join private group DMs, read complete m…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-17613] Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowin…

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-7529] The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthori…

The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of its REST API endpoints being registered with `permission_callback => '__return_true'` in all versions up to, and including, 1.1.16. This makes it possible for unauthenticated attackers to read and modify the plugin's banner, stockbar, and c…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71264] WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no setti…

WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson() with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. Separately, the settings-PIN unlock state is tracked via a single global boolean `correctPIN` (wled0…

nvdaltovulnerabilidad CVSS 8.2 NVD