Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-16925] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege esca…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improper authorization.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76352] In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the…

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could create or modify a scripted lookup through generic configuration endpoints and run an installed lookup script with the permissions of the user account running Splunk Enterprise, which could allow for access to all relevant data and affect system integrity and a…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/08/2026

[CVE-2026-19979] A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE…

A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this vulnerability is the function COPY/MOVE of the component WebDAV Service. Such manipulation leads to authorization bypass. It is possible to launch the attack remotely. The vendor explains: "…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-16879] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass securit…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18509] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-10543] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with …

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-18499] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege es…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

nvdaltovulnerabilidad CVSS 8.1 NVD

V Alto vulnerabilidad

27/07/2026

[CVE-2026-64642] Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16…

Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales can bypass middleware/proxy based authentication. This issue has been fixed in version 16.2.11.

nvdaltovulnerabilidad CVSS 8.2 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60886] Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal …

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process. Successful attacks require human interaction from a person other than the attacker and while the …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-60844] Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update S…

Vulnerability in the Oracle Customer Support product of Oracle E-Business Suite (component: Update Service Request). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customer Support. Successful attacks of this vulnerability can result in unauthorized creation, deletion or m…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32806] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated user can request arbitrary partials or helper-backed render functions through /remote_render. The endpoint does not restrict which partial can be rendered…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32821] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the collection API to evaluate permissions as a different user by supplying `user_email`. If the target us…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

20/07/2026

[CVE-2026-32807] dataCycle is a data management system for centrally storing, managing, searching, finding, and distr…

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, anyone with a DataLink UUID can fetch the attached text file directly, even if the link is expired, the caller is unauthenticated, or the normal show flow would have denied…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16200] A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in…

A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16126] A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h…

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem ear…

nvdaltovulnerabilidad CVSS 7.3 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53515] Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11,…

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to driv…

nvdaltovulnerabilidad CVSS 7.1 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-45337] Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, …

Better Auth is an authentication and authorization library for TypeScript. From 1.6.0 until 1.6.11, the deviceAuthorization plugin treats any authenticated session as the owner of any pending device code because GET /device does not claim the row and POST /device/approve and POST /device/deny short-circuit when userId is unset, allowing an authenticated attacker who learns a valid user_code to bin…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58540] Improper authorization in Windows Installer allows an authorized attacker to elevate privileges loca…

Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-58277] Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privi…

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-54121] Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacke…

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD