Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-14349] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to auth…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-73807] The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functi…

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-66887] The affected products are missing authorization on state-changing CGIs and session checks are not pe…

The affected products are missing authorization on state-changing CGIs and session checks are not performed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

15/09/2026

Vulnerabilidad crítica en PraisonAI permite ejecución remota sin autenticación (CVE-2026-57139)

PraisonAI versiones 1.5.0 a 1.7.2 contienen una falla de seguridad crítica (CVSS 9.8) en MCPServer.startHttp() que expone funciones de herramientas, recursos y prompts sin validación de autenticación. Cualquier cliente en red con acceso al puerto puede ejecutar comandos arbitrarios en sistemas que utilicen esta plataforma de agentes múltiples, afectando servidores en producción en México y Latinoamérica que procesen datos sensibles.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-50006] Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards una…

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that fi…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-57131] PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts pr…

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-75030] Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entit…

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-72709] SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpo…

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_au…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-78361] The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform …

The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request handlers, and does not restrict which option name a caller may supply, allowing unauthenticated users to delete arbitrary WordPress options. This can be used to destroy site and access control configuration, deactivate every installed zipMoney…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

10/09/2026

[CVE-2026-77770] The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does…

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOran…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-84869] A condition in the ScreenConnect client may allow files to be transferred and executed through an ac…

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-83941] Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network…

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-69641] Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg…

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12645] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12646] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-12647] A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authe…

A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/09/2026

[CVE-2026-61410] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

05/09/2026

[CVE-2026-52766] YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki ac…

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any …

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

04/09/2026

[CVE-2026-78328] A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Manage…

A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to escalate privileges to SuperAdmin.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85433] MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing …

MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd=input parameters to open new listeners on arbitrary addresses and redirect or duplicate bus traffic to attacker-controlled destinations.

nvdcriticovulnerabilidad CVSS 9.8 NVD