Alertas de Seguridad de la Información

M Alto vulnerabilidad

03/07/2026

[CVE-2026-10054] In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged term…

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

02/07/2026

[CVE-2026-4767] Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allow…

Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-13125] GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is…

GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the various web-interfaces provided by the GeoVision software and may be necessary for them to function properly. In order to access the websocket …

nvdaltovulnerabilidad CVSS 8.8 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-58126] PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows…

PACSgear PACS Scan 5.2.1 contains an unauthenticated remote code execution vulnerability that allows remote attackers to read and write arbitrary files by exploiting an exposed .NET Remoting TCP service on port 22222 via PGImageExchQueue.exe without any authentication requirement. Attackers can chain the arbitrary file write primitive with DLL hijacking in PGImageExchangeQueueSvc.exe, which loads …

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-58127] PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerE…

PACSgear MediaWriter 5.2.1 exposes a .NET Remoting TCP service on port 9000 via PacsgearMediaServerEngine.dll, registered with ObjectURIs RemoteObj and UIRemoteObj, without any authentication requirement. By exploiting the MarshalByRefObject object unmarshalling technique and implementing .NET WebClient class methods, an unauthenticated remote attacker can read and write arbitrary files on the hos…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56286] Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoi…

Capgo before 12.128.2 contains an authentication bypass vulnerability in the account deletion endpoint that allows deletion without password re-authentication or secondary verification. Attackers can delete user accounts via session hijacking, CSRF attacks, or parameter tampering, resulting in unauthorized account deletion, data loss, and denial-of-service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-58375] JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the…

JimuReport through 2.5.0 exposes the POST /jmreport/auto/export endpoint without authentication: the handler is annotated @JimuNoLoginRequired, so JimuReportTokenInterceptor skips all authentication and authorization, and the export service streams the rendered report for any supplied report id without verifying the auto-export configuration flag. An unauthenticated remote attacker can enumerate S…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-14162] Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allo…

Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

29/06/2026

[CVE-2026-56782] Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restor…

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when admin_api_key is empty, which is the default configuration. Remote attackers can exfiltrate the entire database including user records, items, and feedback data containing personally identifiable information, or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-13546] A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the f…

A vulnerability was found in Feehi CMS up to 2.1.1. This vulnerability affects unknown code of the file /api/articles of the component REST API Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet…

nvdaltovulnerabilidad CVSS 7.3 NVD

B Alto vulnerabilidad

26/06/2026

[CVE-2026-50136] Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an una…

Budibase is an open-source low-code platform. Prior to 3.39.3, the application server exposes an unauthenticated endpoint that generates S3 PutObject presigned URLs using credentials stored in a workspace datasource. The route is protected only by the recaptcha middleware and does not require authentication, table permission, datasource permission, or builder access. A public caller who knows a wo…

nvdaltovulnerabilidad CVSS 7.4 NVD

K Alto vulnerabilidad

26/06/2026

[CVE-2026-13325] A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set…

A flaw was found in KubeVirt's migration proxy. When spec.configuration.migrations.disableTLS is set to true on the KubeVirt custom resource, the target virt-handler binds a plain TCP listener on all interfaces (0.0.0.0/::) on a random port with no authentication, peer allow-list, or handshake token. This listener proxies directly into the target virt-launcher's virtqemud control socket. An attack…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

25/06/2026

[CVE-2026-40702] WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate chargin…

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

nvdcriticovulnerabilidad CVSS 9.4 NVD

F Crítico vulnerabilidad

25/06/2026

[CVE-2025-71327] Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register …

Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create user accounts. Remote attackers can exploit this endpoint to register arbitrary accounts and authenticate to the system, gaining full API access without credentials.

nvdcriticovulnerabilidad CVSS 9.1 NVD

N Alto vulnerabilidad

25/06/2026

[CVE-2026-12490] When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a…

When a provide-xfr is given with a tls-auth-name, a secondary requesting a transfer should provide a client certificate with that name. However, no client certificate is needed when the request comes in over TLS over the regular tls-port (and not the tls-auth-port) or over over TCP over the regular port, when the other conditions of the provide-xfr rule match.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-1840] The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of …

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without restriction. Such unauthorized changes can disrupt normal functionality and, if performed repeatedly, m…

nvdaltovulnerabilidad CVSS 7.5 NVD

R Crítico vulnerabilidad

24/06/2026

[CVE-2026-49980] Rclone is a command-line program to sync files and directories to and from different cloud storage p…

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.46.0 until 1.74.3, rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: /[remote:path]/object. The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute l…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Alto vulnerabilidad

24/06/2026

[CVE-2026-56270] Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability i…

Flowise before 3.1.0 (versions 3.0.13 and earlier) contains a missing authentication vulnerability in the /api/v1/loginmethod endpoint that allows unauthenticated users to retrieve an organization's complete SSO configuration, including OAuth client secrets in cleartext, by providing an organizationId parameter. Remote attackers can send a GET request to harvest sensitive API credentials for Googl…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

23/06/2026

[CVE-2026-54317] Home Assistant is open source home automation software that puts local control and privacy first. Pr…

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not requiring authentication (requires_auth = False). A comment next to that line says auth is instead handled "via the access token from configura…

nvdaltovulnerabilidad CVSS 7.6 NVD

L Crítico vulnerabilidad

23/06/2026

[CVE-2026-55450] Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unaut…

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the server. In addition, in the response, the absolute path of the uploaded file is reported to the attacker, w…

nvdcriticovulnerabilidad CVSS 9.3 NVD