Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/09/2026

[CVE-2026-82302] Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via …

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-78583] Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipula…

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster privilege declarations originating from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents. A user holding Fleet management privileges could therefore cause every Elastic Agent on a targeted policy to rece…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-14199] Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (syn…

Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while th…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84334] Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed …

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/09/2026

[CVE-2026-84335] Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacke…

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-63137] Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrec…

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). A user holding workflow edit permissions could cause scheduled workflow executions to run with the privileges of a different, higher-privileged user, allowing access to and modification of data beyond their own authorization scope.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-58566] Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote acc…

Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

Vulnerabilidad de autorización incorrecta en Dell PowerStore permite escalada de privilegios

Dell PowerStore contiene una vulnerabilidad de autorización incorrecta (CVE-2026-76111, CVSS 8.8) que permite a atacantes autenticados con privilegios bajos ejecutar operaciones administrativas sin autorización. Esta falla de control de acceso afecta directamente a centros de datos y plataformas de almacenamiento empresarial en México y Latinoamérica, comprometiendo la integridad de sistemas altas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/09/2026

[CVE-2026-75921] The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widge…

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instea…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-81892] EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 an…

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-79746] MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/AP…

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.31, when a bearer key with accessType: 'servers' (or 'custom') is used against a group route, isBearerKeyAllowedForRequest grants access to the entire group as long as any single server in that group appears in the key…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/08/2026

Vulnerabilidad alta de omisión de autenticación en pac4j-core anterior a 6.5.6

pac4j-core antes de la versión 6.5.6 contiene una vulnerabilidad que invierte la lógica de validación de tipos de perfil en CheckProfileTypeAuthorizer, permitiendo a atacantes eludir controles de autenticación. Los agresores pueden autenticarse mediante clientes débiles y acceder a recursos que requieren perfiles más robustos al satisfacer validaciones genéricas. Afecta principalmente a aplicaciones Java en LATAM que dependen de esta librería para control de acceso.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55485] Piccolo Admin is an admin interface and content management system for Python, built on top of Piccol…

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is no…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-56854] The source-address critical option in the Permissions returned by an authentication callback was onl…

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

27/08/2026

[CVE-2026-77438] Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.10…

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77611] SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authent…

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal with permissions scoped to a nested object key can overwrite a different object outside that scope by calling PutObjectAcl on the key it is allowed to access. The handler authorizes the request against the requested nested key but then writes the updated entry back to the bucket …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77317] SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, t…

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evaluates configured path permissions with a literal string-prefix comparison, so a user scoped to a path is also granted the same access to any sibling path whose name merely begins with the same characters. A user granted access to /tenants/alice therefore also matches /tenants/alic…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80202] Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), wh…

Kimai before 2.56.0 does not enforce team-membership checks in TimesheetVoter::voteOnAttribute(), which maps permissions only to own_timesheet or other_timesheet. As a result, any authenticated user with ROLE_TEAMLEAD (or a role holding edit_other_timesheet/delete_other_timesheet) can read, modify, and permanently delete timesheets belonging to any user system-wide via the API, regardless of team …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79218] Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker…

Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-78911] Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who…

Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD