Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-49050] General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinSch…

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71506] Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API del…

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuance rights check. Attackers can exploit this misconfigured permission check to zero paid amounts on invoices and remove entries from accountin…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76836] AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not requi…

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPer…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-77234] Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-e…

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76391] In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk ro…

In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could run searches with system-level privileges, access all relevant data, affect system integrity, and read or delete search jobs belonging to other users through Agent Run History. The improper privilege management is possible because the Agent Run History handler replaces the calling user ses…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-68561] Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) ru…

Wekan is open source kanban built with Meteor. Prior to 9.89, the second Boards.allow({ update }) rule in server/permissions/boards.js called canUpdateBoardSort in server/lib/utils.js, which authorized any board member whenever fieldNames included sort. Because Meteor combines allow rules with OR semantics and applies the complete modifier, a comment-only or read-only member could send one Boards.…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17063] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 i…

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and…

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17429] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW95…

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control register…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-17183] Summary An authenticated organization user who can create or edit alert rules in a folder can query…

Summary An authenticated organization user who can create or edit alert rules in a folder can query a datasource for which they do not have datasources:query permission. The attacker sets the client-controlled query field queryType to __expr__ while retaining the UID of a real datasource. The alert-rule authorization path treats the query as a server-side expression and skips datasource permissi…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-41424] Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4…

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.9.0 until 4.10.4 and 4.14.6, PUT /security/users/{user_id} in api/api/controllers/security_controller.py passes request.get("user") instead of request.context['token_info']['sub'] as current_user. remove_nones_to_dict() removes the resulting None value, so the reserved-account protection in framewo…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

19/08/2026

Vulnerabilidad de autorización incorrecta en acmailer permite escalación de privilegios

Existe una vulnerabilidad de autorización deficiente en acmailer (CVSS 8.8) que permite a usuarios crear subcuentas con privilegios administrativos no autorizados. Esta falla afecta directamente la integridad del control de acceso en sistemas de correo empresarial. En LATAM, donde muchas organizaciones dependen de acmailer para gestión de comunicaciones altas, un atacante interno podría comprometer la infraestructura de correo y acceder a información sensible.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-48508] Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPer…

Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-61574] authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Con…

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/08/2026

[CVE-2026-74906] SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-…

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag e…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-9816] Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMe…

Mattermost versions 11.7.x

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-71518] Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download rou…

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms such as dot-slash prefixes, double slashes, or percent-encoded sequences to pass role-based restriction checks while the filesystem resolves …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19629] A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Secu…

A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

14/08/2026

Regresión de autorización en Budibase 3.39.4-3.40.0 expone URLs firmadas de Amazon S3

Budibase versiones 3.39.4 anteriores a 3.40.0 contienen un fallo de control de acceso en el endpoint de carga de adjuntos S3. Usuarios con permisos BASIC pueden obtener URLs presignadas PutObject de buckets S3 arbitrarios, permitiendo escritura no autorizada en almacenamiento en la nube. Afecta directamente a empresas en LATAM que usan Budibase para gestión de contenidos y datos empresariales.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

14/08/2026

Vulnerabilidad de autorización en plugin Flex Objects afecta CMS Grav

El plugin Flex Objects (versiones hasta 1.4.6) en Grav CMS contiene un fallo de control de acceso en su API que permite a usuarios autenticados con permisos básicos ejecutar operaciones sin validar restricciones de campo, usuario o administrador. Afecta principalmente a sitios que exponen la Flex API sin restricciones de red. Empresas en LATAM usando Grav para portales internos o públicos deben verificar su configuración de permisos inmediatamente.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73841] OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0…

OpenChoreo is a complete, open-source developer platform for Kubernetes. From 1.2.0-rc.1 until 1.2.0, internal/openchoreo-api/api/handlers/exec.go and internal/openchoreo-api/api/handlers/wirelogs.go authorize component:exec and wirelogs:view using the caller-supplied project query parameter instead of comp.Spec.Owner.ProjectName, allowing a user with a project-scoped grant to execute commands in …

nvdaltovulnerabilidad CVSS 8.8 NVD