Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/08/2026

Bypasa de autenticación en User Profile Builder para WordPress (CVE-2026-15826)

El plugin User Profile Builder para WordPress versiones hasta 3.16.4 contiene una vulnerabilidad crítica (CVSS 9.8) que permite bypasear autenticación mediante confusión de tipos en la función wppb_log_in_user(). Un atacante puede registrarse con nombres de usuario de 61-70 caracteres para eludir validaciones y acceder sin credenciales válidas. Afecta directamente a sitios WordPress en empresas LATAM que dependen de este plugin para gestión de usuarios y control de acceso.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin 6Storage Rentals para WordPress

El plugin 6Storage Rentals para WordPress (versiones hasta 2.27.0) contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes eludir la autenticación y acceder a cuentas de usuarios sin credenciales válidas. La falla reside en el manejador AJAX six_storage_create_wp_user() que se ejecuta sin validar tokens de seguridad, permisos ni propiedad de usuario, permitiendo la ejecución de funciones sensibles como wp_set_current_user() y wp_set_auth_cookie(). Afecta principalmente a sitios WordPress con comercio electrónico o alquileres en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin User Session Synchronizer para WordPress (CVE-2026-15341)

El plugin User Session Synchronizer para WordPress en versiones hasta 1.4.0 contiene una vulnerabilidad de bypass de autenticación (CVSS 9.8) que permite la toma de control de cuentas sin validación de nonce, permisos o secretos compartidos. Un atacante puede explotar parámetros sin protección (`ussync-key`, `ussync-token`, `ussync-ref`) ejecutados en cada solicitud para secuestrar sesiones de usuarios, incluidas administrativas. Afecta directamente a medianas y grandes empresas en LATAM que alojan WordPress en infraestructura local o en la nube con este plugin activo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-49457] erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not au…

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificate, so `verify` was effectively a no-op on the client. A man-in-the-middle on the network path could pr…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-73849] Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=r…

Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en getgrav/grav-plugin-api: escalada de privilegios en desactivación de 2FA

El paquete Composer getgrav/grav-plugin-api versiones

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

Vulnerabilidad crítica en plugin Grav API permite escalación de privilegios

El plugin getgrav/grav-plugin-api anterior a la versión 1.0.13 no valida correctamente que los permisos de nuevas claves API sean un subconjunto de los permisos del solicitante. Un atacante con una clave API de bajo privilegio puede crear claves con permisos elevados, comprometiendo aplicaciones Grav alojadas en México y Latinoamérica. Esta vulnerabilidad afecta directamente portales de contenido, sistemas de gestión documental y plataformas educativas que utilizan este plugin.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73842] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72850] Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to…

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .. segments that escape the temporary directory during workspace export, writing arbitrary content to any path writable by the Budibase process.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-72851] Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered …

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials, enabling data exfiltration, modification, and persistence in connected datasources like Snowflake.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73656] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predica…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73532] Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered p…

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploa…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73533] Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered …

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administ…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49827] WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1…

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73501] kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() i…

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on Valida…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73519] WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every buil…

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management po…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-63298] An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration …

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execut…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73296] Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on TCP ports 8020 and 8021 without authentication, allowing an unauthenticated remote attacker to invoke capture_screenshot, get_ui_t…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73294] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, reposi…

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This i…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-26035] An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through …

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

nvdcriticovulnerabilidad CVSS 9.8 NVD