Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/07/2026

[CVE-2026-34044] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user to access logs for applications owned by other teams by supplying a victim resource UUID. This issue is fixed in version 4.0.0-beta.466.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

06/07/2026

[CVE-2026-59712] Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing aut…

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hija…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-46585] Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache …

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads the search phrase from an Exchange header (LuceneConstants.HEADER_QUERY) whose value was the plain string QUERY (and RETURN_LUCENE_DOCS for HEADER_RETURN_LUCENE_DOCS). Because these names do not start with the Camel / camel prefix, HttpHeaderF…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/07/2026

[CVE-2026-14753] A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. …

A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/notes of the component Note Handler/Assignment Handler. Performing a manipulation of the argument assignment_item_id results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used. Continious …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-28740] Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source obj…

Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-unit access.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-27657] Gitea versions before 1.25.5 allow a user to change another user's primary email address.

Gitea versions before 1.25.5 allow a user to change another user's primary email address.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-53903] MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servl…

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint. The application does not properly validate whether an authenticated user is authorized to access a requested document, allowing direct retrieval based on a user-supplied identifier. An attacker can access trading documents belonging to other…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56230] Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() …

Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header without validating ownership, allowing authenticated users to adopt cross-tenant limited keys. Attackers can supply another tenant's limited key ID to bypass authorization checks and access unauthorized cross-tenant resources across multiple…

nvdaltovulnerabilidad CVSS 8.8 NVD

L Crítico vulnerabilidad

30/06/2026

[CVE-2026-10140] IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows…

IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-12073] The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privil…

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.9.9.5. This is due to the plugin not validating a `user_login` on registration forms that don't contain this parameter, and not properly handling the error messages. This makes it possible for unauthenticated attackers to ch…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-34592] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups are not scoped to the current team, allowing any authenticated user to access servers and projects belonging to other teams by specifying their IDs directly. This vulnerability is fixed in 4.0.0-beta.471.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-57498] Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. …

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowi…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-56780] Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/a…

Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administrators to change any user's password. Attackers with domain admin privileges can bypass object-level access controls to reset superadmin passwords and achieve full account takeover.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

26/06/2026

[CVE-2026-52782] OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there…

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects//settings/project_storages/ via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources. A project-admin in one project can hijack the managed Nextcloud or OneDrive folder of another project on the same storage…

nvdcriticovulnerabilidad CVSS 9.9 NVD

C Alto vulnerabilidad

26/06/2026

[CVE-2026-12411] Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrust…

Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-56069] Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54839] Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &a…

Unauthenticated Sensitive Data Exposure in Trinity Backup &#8211; Backup, Migrate, Restore, Clone &amp; Schedule Backups

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/06/2026

[CVE-2026-54826] Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions.

Subscriber Insecure Direct Object References (IDOR) in SupportCandy

nvdaltovulnerabilidad CVSS 7.6 NVD

R Alto vulnerabilidad

25/06/2026

[CVE-2026-9099] A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint…

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-52799] Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the …

Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository. In a test environment with REQUIRE_SIGNIN_VIEW = false, we confirmed that an unauthenticated user can download attachments belonging to a private repository. Th…

nvdaltovulnerabilidad CVSS 7.5 NVD