Alertas de Seguridad de la Información

M Crítico vulnerabilidad

15/06/2026

[CVE-2026-48114] Metacat is data repository software that helps researchers preserve, share, and discover data. Versi…

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT against HARVEST_SITE_SCHEDULE via string concatenation, using a quoteString() helper that performs raw single-quote wrapping without escaping. Th…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/06/2026

[CVE-2026-12183] Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains a…

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentication vulnerability (CWE-287) in the system configuration module. The /php/ajax-login.php endpoint returns userid=1 (administrator) in response to any HTTP POST request that supplies arbitrary credentials (e.g., action=dologin&login=&pwd=), and subsequent pr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-48611] Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth i…

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorized access in default installations.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-45567] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, there is an authentication bypass vulnerability via 'api' substring in URL + unauthenticated /api/gpt. At time of publication, there are no publicly available patches.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

09/06/2026

[CVE-2026-36727] An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows…

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44810] Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate…

Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-41720] Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a …

Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password. Affected versions: Spring LDAP 2.4.0 through 2.4.4; 3.2.0 through 3.2.17; 3.3.0 through 3.3.7; 4.0.0 through 4.0.3.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11618] A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function pr…

A vulnerability was determined in DTStack Taier up to 1.4.0. The affected element is the function preHandle of the file taier-data-develop/src/main/java/com/dtstack/taier/develop/interceptor/LoginInterceptor.java of the component Source Connection Test Endpoint. Executing a manipulation can lead to improper authentication. The attack may be performed from remote. The exploit has been publicly disc…

nvdaltovulnerabilidad CVSS 7.3 NVD

D Crítico vulnerabilidad

05/06/2026

[CVE-2026-46389] UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs…

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernete…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-6274] Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerabi…

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

04/06/2026

[CVE-2026-49191] The production build of the M3WebServer hard-codes its backend API keys, which can be easily interce…

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49194] The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prom…

The debugging routine SCREEN_CLICK(5053) enables a connection to skip the standard device login prompt entirely and directly enter an interactive shell interface.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49202] Internal multimedia session archives are accessible without authentication, exacerbated by loose Cro…

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource Sharing (CORS) rules that allow cross-site theft.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49203] Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, …

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

nvdaltovulnerabilidad CVSS 8.3 NVD

A Crítico vulnerabilidad

04/06/2026

[CVE-2026-49186] The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any clie…

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-10777] A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b8…

A vulnerability was identified in ealpha072 Student-Management-System up to 01451bd7a2f58cdda07bd0b86e3967582e3ecd08. Affected by this issue is some unknown functionality of the file admin/config.php of the component Administrative Backend. Such manipulation leads to improper authentication. The attack may be performed from remote. The exploit is publicly available and might be used. This product …

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

02/06/2026

[CVE-2026-49443] authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, …

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

02/06/2026

[CVE-2026-49448] authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, …

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10619] A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93…

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or update…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

02/06/2026

[CVE-2026-5076] The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in a…

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. Th…

nvdcriticovulnerabilidad CVSS 9.8 NVD