Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101188] A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects …

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638. This issue affects the function routerd.passwd_set of the file /ubus. Such manipulation leads to weak password recovery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

27/09/2026

[CVE-2026-100870] Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-res…

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93453] SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the a…

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastruc…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

13/09/2026

[CVE-2026-90522] A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b…

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-6285] Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Tech…

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Password Recovery Exploitation. This issue affects LIBRID/LIBREF: from 2.01.0.2183 through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-80196] Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remai…

Kimai before 2.58.0 contains an authentication bypass vulnerability where password reset links remain valid after password changes because the LoginLink signature covers only the user id, not the password hash. Attackers who intercept or cache a password reset link can use it up to 2 additional times within a 1-hour window to log in as the user even after the legitimate user has changed their pass…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72856] Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/globa…

Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC ap…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-61181] Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply …

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks require human intera…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61049] Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Int…

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Production Scheduling executes to compromise Oracle Production S…

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60658] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Conten…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker…

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60646] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the att…

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60648] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the att…

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60650] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the att…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-56308] Capgo before 12.128.2 allows email address changes without requiring current password re-authenticat…

Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification of the existing email address. An attacker with access to a valid session cookie or authenticated browser can change the account email to gain control of account recovery and bypass multi-factor authentication protections.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

12/07/2026

[CVE-2026-15479] A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function chang…

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file /api/login/modify of the component Administrator Password Modification Endpoint. The manipulation of the argument newPass results in weak password recovery. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early ab…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-15155] The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is v…

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Authenticated Account Takeover via Email Header Injection in all versions up to, and including, 6.6.10 This is due to insufficient server-side validation of a Login/Register widget setting used to construct outgoing email headers — the allowed-values restriction is enforced only in the …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-7655] The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in vers…

The SureCart plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 4.2.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email during customer profile synchronization from webhook events. This makes it possible for unauthenticated attackers to change linked user's email addresses, …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

09/07/2026

[CVE-2026-55207] Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an …

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the vic…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

07/07/2026

[CVE-2026-13020] A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions …

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism. ArcGIS Administrators should configure an email server with ArcGIS Enterprise to facilitate user self-service password recovery. The ability for…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53904] MCO is vulnerable to Account Denial of Service due to improper implementation of password reset func…

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality. Each password reset request invalidates previously set password as well as previously issued temporary passwords, furthermore, password resets are not limited in any way. An attacker who provides victim's email and answer to their security question, can successfully initiate the reset pro…

nvdaltovulnerabilidad CVSS 7.1 NVD