Alertas de Seguridad de la Información

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-9695] An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2…

An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-12153] The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up t…

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-9701] The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versio…

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user requests a password reset. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom reset action to set a new password for…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-14487] The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insuff…

The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-56843] Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged…

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions. This results in cross-tenant disclosure of other tenants' FTP credentials stored in cleartext, which can be levera…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-59705] mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthe…

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints wit…

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Crítico vulnerabilidad

07/07/2026

[CVE-2026-14739] DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extre…

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.

nvdcriticovulnerabilidad CVSS 9.8 NVD

P Crítico vulnerabilidad

07/07/2026

[CVE-2026-14740] DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial …

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal bu…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37270] Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused…

Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and the presence of hard-coded credentials in the firmware.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-37271] Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, T…

Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-59706] mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow s…

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm en…

nvdcriticovulnerabilidad CVSS 9.3 NVD

C Crítico vulnerabilidad

07/07/2026

[CVE-2026-46354] Coder allows organizations to provision remote development environments via Terraform. In versions p…

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"v…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-58473] Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated at…

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-59800] 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /ap…

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs …

nvdcriticovulnerabilidad CVSS 9.8 NVD

E Crítico vulnerabilidad

07/07/2026

[CVE-2026-13019] Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing aut…

Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API.

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Crítico vulnerabilidad

07/07/2026

[CVE-2026-53481] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vuln…

nvdcriticovulnerabilidad CVSS 9.8 NVD

D Crítico vulnerabilidad

07/07/2026

[CVE-2026-53483] Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through…

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 an improper authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. This is a critical s…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2011-10043] Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Mo…

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

07/07/2026

[CVE-2026-33264] A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-contro…

A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Us…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/07/2026

[CVE-2026-12375] The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after …

The uncanny-automator-pro WordPress plugin before 7.3.0.6 was distributed with malicious code after the vendor's uncanny-automator-pro WordPress plugin before 7.3.0.6 update/distribution infrastructure was compromised; the injected backdoor grants unauthenticated attackers an administrator session on affected sites and beacons the site's secret keys and administrator details to attacker-controlled…

nvdcriticovulnerabilidad CVSS 9.8 NVD