Alertas de Seguridad de la Información

J Alto vulnerabilidad

27/07/2026

[CVE-2026-42016] JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation at…

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-17568] Improper access control in the role membership management endpoint in Devolutions Server allows an a…

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-59689] An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Ob…

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-8789] The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to…

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-15704] In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln…

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/07/2026

[CVE-2026-15630] A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or mod…

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

nvdcriticovulnerabilidad CVSS 9.9 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65596] n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restrict…

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a cr…

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

22/07/2026

[CVE-2026-65015] n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature whe…

n8n versions before 2.30.1 contain a privilege escalation vulnerability in the AI Agents feature where the node-execution tool lacks proper authorization checks. A Project Viewer user can escalate privileges by chatting with an agent that has node tools enabled, executing arbitrary nodes and accessing credential secrets without proper authorization verification.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-61325] Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Interna…

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Internal Operations). The supported version that is affected is 12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Advanced Benefits. While the vulnerability is in Oracle Advanced Benefits, attacks may significantly impact addition…

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60951] Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal O…

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modifica…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Crítico vulnerabilidad

21/07/2026

[CVE-2026-60663] Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Co…

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significa…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

21/07/2026

[CVE-2026-60320] Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset…

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Patchset Assistant). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in unauthorized access to criti…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/07/2026

[CVE-2026-47697] Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organi…

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization (workspace). Prior to version 1.20.2, several endpoints accepted entity IDs from request input and `connect`-ed / read / updated them without verifying the IDs belonged to the caller's organization. An authenticated user in Org A who knew or obtained an ID belonging to Org B could act on Org …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

21/07/2026

[CVE-2026-65049] Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorizat…

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_a…

nvdcriticovulnerabilidad CVSS 9.3 NVD

L Alto vulnerabilidad

21/07/2026

[CVE-2026-59851] A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does no…

A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

20/07/2026

[CVE-2026-44231] RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6…

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10, 6.0.0 and above, prior to 6.0.3 contain an information disclosure and privilege escalation vulnerability in the REST 2.0 API. A privileged (non-administrative) user can obtain authentication credentials belonging to other users — including users with administrative privileges — and use those credenti…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

19/07/2026

[CVE-2026-16200] A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in…

A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_invoke of the file claw/services/swarm/swarm.c of the component RPC Handler. The manipulation leads to incorrect authorization. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-10130] QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to…

QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching Identity via a Cypher MERGE operation before checking whether the email belongs to an existing account, …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-16126] A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h…

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm RPC Receiver. This manipulation causes incorrect authorization. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem ear…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

18/07/2026

[CVE-2026-47866] VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the ne…

VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of the Avi Control Plane without proper authorization. Affected versions: 32.1.1 (fixed in 32.1.2) 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)

nvdaltovulnerabilidad CVSS 8.3 NVD