Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/09/2026

[CVE-2026-57579] Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15…

Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/pages/nested endpoint implemented by Api::PagesController#nested in app/controllers/alchemy/api/pages_controller.rb returns an unfiltered page tree because it performs no authorization and does not scope descendants by the caller's ability. A…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-57131] PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts pr…

PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs without authentication or per-job authorization. Network clients can submit attacker-controlled prompts and agent configuration, list and read jobs, stream results, and cancel or delete other jobs, exposing service credentials and connected tool c…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90933] laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API …

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST /api/admin/licenses/store, and POST /api/admin/licenses/remove endpoints to disclose confidential license keys…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

14/09/2026

[CVE-2026-75030] Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entit…

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad de escalación de privilegios en Mattermost permite acceso no autorizado a canales restringidos

Mattermost versiones 11.9.0, 11.8.4, 11.7.7 y 10.11.22 o anteriores presentan una falla en la validación de permisos de gestión de miembros de canal durante la creación de ejecuciones de playbooks. Un miembro autenticado del canal puede adicionar usuarios arbitrarios a canales restringidos mediante el campo propietario de la ejecución. Esta vulnerabilidad (MMSA-2026-00677, CVSS 7.1) afecta principalmente a organizaciones en LATAM que utilizan Mattermost como plataforma de colaboración interna con canales de acceso controlado.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/09/2026

Vulnerabilidad alta en CAPEv2: falta de validación de propiedad en API REST

CAPEv2 hasta el commit 471ee4b presenta una falla de control de acceso en sus endpoints REST que permite a usuarios autenticados leer y eliminar análisis de malware enviados por otros usuarios. Los atacantes pueden enumerar todas las tareas del sistema y borrar análisis arbitrarios sin verificación de propiedad, comprometiendo la integridad de investigaciones de seguridad en laboratorios de análisis dinámico.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/09/2026

[CVE-2026-90537] WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization…

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid dail…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-62089] Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse…

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

11/09/2026

[CVE-2026-72709] SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpo…

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_au…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/09/2026

[CVE-2026-38056] A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmwar…

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole communications link for offshore rigs, vessels, and remote sites. Important context: the device ships from the factory with a pre-configured l…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81211] IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitra…

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-89054] A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authen…

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration and SNMP data collection (which enable and disable event definitions and data-collection sources) are re…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88959] Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoi…

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, ga…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-4129] There is an improper access control vulnerability in NI SystemLink that may allow an authenticated u…

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior versions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84821] Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions.

Unauthenticated Broken Access Control in WP Fast Total Search

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81799] Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 version…

Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81801] Subscriber Settings Change in WP-Stateless <= 4.4.1 versions.

Subscriber Settings Change in WP-Stateless

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81794] Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81786] Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions…

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

10/09/2026

Vulnerabilidad alta en GeoVision GV-LPC2211 V1.13 permite escalada de privilegios

La cámara IP GeoVision GV-LPC2211 versión 1.13 contiene una vulnerabilidad que permite a usuarios invitados sobrescribir la configuración del dispositivo y reemplazar la contraseña del administrador a través del servicio SSVR. Esta falla afecta directamente a sistemas de videovigilancia desplegados en México y Latinoamérica, poniendo en riesgo el acceso no autorizado a infraestructura alta de seguridad física.

nvdaltovulnerabilidad CVSS 8.8 NVD