Alertas de Seguridad de la Información

O Alto vulnerabilidad

09/07/2026

[CVE-2026-59224] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, backend/open_webui/routers/terminals.py built the ws_terminal upstream URL from an unencoded session_id and appended user_id as a query parameter, allowing query injection to make the terminal backend resolve another user identity; the HTTP proxy path also forwarded X-User-Id as an integrity-unbo…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54781] CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior …

CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML token validation does not enforce SubjectConfirmation method URIs or holder-of-key proof keys in SamlSecurityTokenHandler, allowing holder-of-key downgrade or custom confirmation method assertions to authenticate a subject without proving authority over the assertion…

nvdaltovulnerabilidad CVSS 7.4 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-59822] LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.…

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a va…

nvdaltovulnerabilidad CVSS 8.2 NVD

L Alto vulnerabilidad

08/07/2026

[CVE-2026-58253] NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr…

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no_auth_user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55076] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_verified` with a direct Go `bool` type assertion. When an IdP returned the claim as a non-boolean (for example the string `"false"`) or omitted it, the assertion failed open and the email was treated as verified. Combined …

nvdaltovulnerabilidad CVSS 7.4 NVD

C Alto vulnerabilidad

07/07/2026

[CVE-2026-55075] Coder allows organizations to provision remote development environments via Terraform. Prior to vers…

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained into account takeover. Email-based user matching fell back to linking by email without checking for an existing link to a different IdP subject and the `email_verified` claim was only enforced when present as a boolean …

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

nvdaltovulnerabilidad CVSS 7.5 NVD

B Alto vulnerabilidad

06/07/2026

[CVE-2026-40138] A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Re…

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configur…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2026-14622] A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d…

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajax_files of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product ado…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-58423] LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repo…

LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56219] Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rb…

Capgo before 12.128.2 contains a NULL-auth bypass vulnerability in the public.get_org_user_access_rbac function that allows unauthenticated attackers to retrieve RBAC role bindings and member email addresses. Attackers can exploit improper NULL comparison in the authorization gate to disclose organization membership, roles, and email addresses via the PostgREST RPC endpoint using only a public API…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

30/06/2026

[CVE-2026-10560] IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/buil…

IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in information disclosure and denial of service.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-41896] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the HMAC key is the application's manual_webhook_secret_github field, which is used by Coolify's webhook endpoints to validate incoming requests, is nullable with no default — meaning newly created applications have a null webhook secret. PHP's hash_hmac() function silently …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13546] A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the f…

A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

W Alto vulnerabilidad

25/06/2026

[CVE-2026-11703] Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding c…

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption n…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-55759] Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8…

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss is accepted regardless of aud, exp, nbf, or nonce. An attacker who obtains a target user's Apple identity token (from serv…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56223] Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-us…

Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization. An attacker with enterprise org admin access and a malicious IdP can forge SAML assertions containing victim email addresses to trigger account merge and ga…

nvdaltovulnerabilidad CVSS 8.7 NVD

R Alto vulnerabilidad

23/06/2026

[CVE-2026-12112] A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server all…

A flaw was found in the foreman-mcp-server. A session management vulnerability in the MCP Server allows unauthenticated attackers to hijack active administrative sessions due to an improper cache of authenticated client connections, by trusting a non-secret session ID without re-validating authentication tokens and by logging all newly created session IDs to standard logs. This issue can result in…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-54320] Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor…

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization invitations could be accepted (and declined) by a user whose email matched the invitation but had not been verified. Daytona authenticates users via OIDC and matches an invitation's target email against the email in the caller's token, but the invitation accept…

nvdaltovulnerabilidad CVSS 8.4 NVD

C Alto vulnerabilidad

23/06/2026

[CVE-2026-52845] Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_…

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the…

nvdaltovulnerabilidad CVSS 8.1 NVD