Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48763] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoi…

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` URL for that exact key. Because the endpoint only checks that the referenced typebot is public and that the referenced block is a file input bl…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48765] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator …

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readable bot configuration and then overwrite that credential through `handleUpdateOAuthCredentials()` by supplying an attacker-controlled writable `workspaceId`. The update path validates only the attacker-supplied workspace and then updates the c…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-66145] An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044)…

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-45618] LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possi…

LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, it is possible to execute arbitrary code with crafted templates. Version 10.26.0 patches the issue.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-73222] Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the…

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/i…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-18691] An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable networ…

An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to be transmitted in a less-protected form, potentially allowing that credential to be recovered. If recov…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-71398] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-71362] Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privileg…

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48447] Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbit…

Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is chan…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48767] TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a …

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access tok…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48441] Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pa…

Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scop…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48415] Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Securi…

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48416] Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Securi…

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48407] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48408] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48409] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48410] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48397] Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result…

Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48404] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-48405] Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary…

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD