Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/08/2026

[CVE-2026-53977] OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remot…

OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown ha…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18277] Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 2…

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18359] Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through…

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and n…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18427] @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. …

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegating to the send layer. As a result, an unauthenticated attacker could request a file protected by a route…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18258] Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoint…

Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70646] aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHand…

aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65554] Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-53975] OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remot…

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn() without any allowlist, blocklist, or argument validation. The authentication middleware becomes a no-op when UI_PASSWORD is not configured,…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-28172] Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager <= 2.6.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Tracking Code Manager

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-57818] A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code …

A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-61466] In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and st…

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-63687] Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization…

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP req…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-57819] Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFo…

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing  requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default li…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-16268] The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing r…

The Newsletters WordPress plugin before 4.16 does not authenticate or validate a bounce-processing request before fetching a user-supplied URL on the server side, allowing unauthenticated attackers to make the site issue requests to arbitrary internal or external hosts.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/08/2026

Vulnerabilidad alta de SSRF en JeecgBoot hasta versión 3.9.2

Se identificó una vulnerabilidad de falsificación de solicitudes del lado del servidor (SSRF) en JeecgBoot versiones hasta 3.9.2, específicamente en el componente Anonymous Chat Attachment Parser (/airag/chat/send). El defecto permite a atacantes remotos ejecutar solicitudes HTTP arbitrarias desde el servidor afectado, comprometiendo sistemas internos y datos sensibles. La vulnerabilidad tiene código de explotación público disponible, aumentando significativamente el riesgo para empresas LATAM que usan esta plataforma en producción.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

Vulnerabilidad alta de elusión de autenticación en plugin WPMU DEV Dashboard para WordPress

El plugin WPMU DEV Dashboard para WordPress (versiones hasta 5.0.0) contiene una vulnerabilidad de elusión de autenticación que afecta sitios no conectados al WPMU DEV Hub. La clave API del sitio permanece vacía en la configuración predeterminada, permitiendo falsificar firmas de solicitud WDP-AUTH. Esto expone a empresas mexicanas y latinoamericanas con sitios WordPress multisite a acceso no autorizado a funcionalidades administrativas altas.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18973] A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is …

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-67870] In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation …

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node pointer to remain NULL while execution continues.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-52466] Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The appl…

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the act…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-34966] Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated…

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints …

nvdaltovulnerabilidad CVSS 7.6 NVD