Alertas de Seguridad de la Información

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58275] Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a netw…

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-47724] nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to v…

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api/hosts.go:384`: "API trusts the bearer token for authorisation; per-CA ownership is enforced only in the Web layer." The Web UI gates state-c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65916] CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in…

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests with arbitrary backupCancellationDomain and fileName parameters to terminate backup processes, delete backup archives, corrupt backup status…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65895] Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin con…

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials en…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65500] Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPres…

Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65495] Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

Unauthenticated Broken Access Control in Dokan Pro

nvdaltovulnerabilidad CVSS 7.5 NVD

J Alto vulnerabilidad

23/07/2026

[CVE-2026-64814] In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Developme…

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-61954] Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

Unauthenticated Broken Access Control in PayU India

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-59547] Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions…

Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-61943] Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Broken Access Control in WPDM – Premium Packages

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-57367] Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15015] The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypa…

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain an administrator-bound OAuth Bearer token via a self-registered client, granting full admini…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-12082] The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of…

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2026-13078] A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine uncond…

A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB se…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61267] Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (componen…

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Configuration Workbench. Successful attacks of this vulnerability can result in unauthorized upd…

nvdaltovulnerabilidad CVSS 7.3 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60953] Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite…

Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Telecommunications Billing Integrator. Successful attacks of this vulnerability can result i…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47688] FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version…

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power mana…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47413] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(wo…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-47416] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role="member"` and is never overridden by the route. The handler then calls `MemberService.update_r…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47412] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including e…

nvdaltovulnerabilidad CVSS 8.1 NVD