Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin 6Storage Rentals para WordPress

El plugin 6Storage Rentals para WordPress (versiones hasta 2.27.0) contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes eludir la autenticación y acceder a cuentas de usuarios sin credenciales válidas. La falla reside en el manejador AJAX six_storage_create_wp_user() que se ejecuta sin validar tokens de seguridad, permisos ni propiedad de usuario, permitiendo la ejecución de funciones sensibles como wp_set_current_user() y wp_set_auth_cookie(). Afecta principalmente a sitios WordPress con comercio electrónico o alquileres en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin User Session Synchronizer para WordPress (CVE-2026-15341)

El plugin User Session Synchronizer para WordPress en versiones hasta 1.4.0 contiene una vulnerabilidad de bypass de autenticación (CVSS 9.8) que permite la toma de control de cuentas sin validación de nonce, permisos o secretos compartidos. Un atacante puede explotar parámetros sin protección (`ussync-key`, `ussync-token`, `ussync-ref`) ejecutados en cada solicitud para secuestrar sesiones de usuarios, incluidas administrativas. Afecta directamente a medianas y grandes empresas en LATAM que alojan WordPress en infraestructura local o en la nube con este plugin activo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17175] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-17182] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and ob…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-48528] Metacat is data repository software that helps researchers preserve, share, and discover data. Metac…

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints due to unsanitized user input that can be passed through to the backend SQL database. The `nodeId` parameter can be modified to inject SQL commands, an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17099] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17101] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73655] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the ne…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16867] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17197] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

13/08/2026

Vulnerabilidad crítica de autenticación impropia (CVE-2026-59500) afecta múltiples productos

Se ha identificado una vulnerabilidad de severidad crítica (CVSS 10.0) en mecanismos de autenticación de múltiples fabricantes, permitiendo a atacantes eludir controles de acceso sin credenciales válidas. Esta falla afecta directamente infraestructuras críticas en México y Latinoamérica que dependen de sistemas de identificación y acceso. El impacto abarca compromisos totales de confidencialidad, integridad y disponibilidad en sistemas afectados.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-14182] The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly val…

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73501] kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() i…

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on Valida…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2024-27253] IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass secur…

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-11923] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-12359] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-42018] JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when an…

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-50561] Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor…

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment ins…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-26035] An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through …

An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/08/2026

Vulnerabilidad alta de autenticación en plugin WordPress Passwordless Login de VentraConnect

El plugin 'Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login' para WordPress (versiones hasta 1.4.3) contiene un fallo de autenticación que permite eludir el acceso mediante verificación insuficiente del correo electrónico devuelto por Spotify. Un atacante podría acceder a cuentas sin credenciales válidas. Afecta directamente a sitios WordPress en México y LATAM que implementen este plugin con autenticación social.

nvdaltovulnerabilidad CVSS 8.1 NVD