Alertas de Seguridad de la Información

M Crítico vulnerabilidad

27/07/2026

[CVE-2026-13332] The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unaut…

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-12877] The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not saniti…

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0's standard front-end issue-tracker configuration.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-62825] Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges ove…

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-56191] Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tamp…

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15981] The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in a…

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful sign…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15611] Logto allows unverified email-based SSO account linking, enabling an attacker to register an identit…

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60367] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

22/07/2026

[CVE-2026-62144] An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security …

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a conf…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61233] Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (c…

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil. Successful attacks of this vulnerability can result in takeover of Pe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61183] Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply …

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Reporting). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61178] Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply …

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result i…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-61154] Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (com…

Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce (component: Forge). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search Platform Services. Successful attacks of this vulnerability can result in takeover of Oracle …

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61129] Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). …

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: ATG Portals). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61131] Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Applicat…

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-61065] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Ma…

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-60568] Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime…

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact …

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-60333] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impac…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-60326] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, dele…

nvdcriticovulnerabilidad CVSS 9.1 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-60328] Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentic…

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Ma…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-53595] FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version …

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` (`OpenController@userSetupSave`) selects the target account solely by its `invite_hash` column, then overwrites that account's email and password and logs in as it. No authentication, cookie, or prior session is required. After …

nvdcriticovulnerabilidad CVSS 9.4 NVD