Alertas de Seguridad de la Información

M Crítico vulnerabilidad

16/08/2026

[CVE-2026-19924] A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability…

A security vulnerability has been detected in Tenda AC10 16.03.10.09_multi_TDE01. This vulnerability affects the function R7WebsSecurityHandler of the component httpd. The manipulation leads to improper authentication. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/08/2026

[CVE-2026-73054] SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoi…

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream includin…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin 6Storage Rentals para WordPress

El plugin 6Storage Rentals para WordPress (versiones hasta 2.27.0) contiene una vulnerabilidad crítica (CVSS 9.8) que permite a atacantes eludir la autenticación y acceder a cuentas de usuarios sin credenciales válidas. La falla reside en el manejador AJAX six_storage_create_wp_user() que se ejecuta sin validar tokens de seguridad, permisos ni propiedad de usuario, permitiendo la ejecución de funciones sensibles como wp_set_current_user() y wp_set_auth_cookie(). Afecta principalmente a sitios WordPress con comercio electrónico o alquileres en México y Latinoamérica.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/08/2026

Vulnerabilidad crítica de bypass de autenticación en plugin User Session Synchronizer para WordPress (CVE-2026-15341)

El plugin User Session Synchronizer para WordPress en versiones hasta 1.4.0 contiene una vulnerabilidad de bypass de autenticación (CVSS 9.8) que permite la toma de control de cuentas sin validación de nonce, permisos o secretos compartidos. Un atacante puede explotar parámetros sin protección (`ussync-key`, `ussync-token`, `ussync-ref`) ejecutados en cada solicitud para secuestrar sesiones de usuarios, incluidas administrativas. Afecta directamente a medianas y grandes empresas en LATAM que alojan WordPress en infraestructura local o en la nube con este plugin activo.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-17175] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-17182] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and ob…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

14/08/2026

[CVE-2026-48528] Metacat is data repository software that helps researchers preserve, share, and discover data. Metac…

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints due to unsanitized user input that can be passed through to the backend SQL database. The `nodeId` parameter can be modified to inject SQL commands, an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17099] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17101] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73655] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the ne…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-16867] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17197] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

13/08/2026

Vulnerabilidad crítica de autenticación impropia (CVE-2026-59500) afecta múltiples productos

Se ha identificado una vulnerabilidad de severidad crítica (CVSS 10.0) en mecanismos de autenticación de múltiples fabricantes, permitiendo a atacantes eludir controles de acceso sin credenciales válidas. Esta falla afecta directamente infraestructuras críticas en México y Latinoamérica que dependen de sistemas de identificación y acceso. El impacto abarca compromisos totales de confidencialidad, integridad y disponibilidad en sistemas afectados.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-14182] The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly val…

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-73501] kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() i…

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.144.0, ValidationHandler.Load() in openapi3filter/validation_handler.go silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which returns nil without checking credentials. This substitution causes every OpenAPI security requirement to be satisfied for unauthenticated requests when an application relies on Valida…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2024-27253] IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass secur…

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-11923] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-12359] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-42018] JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when an…

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/08/2026

[CVE-2026-50561] Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platfor…

Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, the project's authentication mechanism contains a flaw. In affected versions, the system does not sufficiently validate the identity token in the Authorization header — only performing a validity check. This allows an administrator token generated in another deployment ins…

nvdcriticovulnerabilidad CVSS 9.4 NVD