Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en V-Secure Jingyun Antivirus 2.4.2.39 permite escalada de privilegios

Se ha identificado una vulnerabilidad de control de acceso impropio en el controlador de kernel ZyArk.sys de V-Secure Jingyun Antivirus versión 2.4.2.39 (CVSS 7.8). Esta falla requiere acceso local pero permite que un atacante escale privilegios en sistemas Windows. El exploit está públicamente disponible y el fabricante no ha respondido a la divulgación responsable, lo que aumenta el riesgo inmediato para empresas en México y LATAM que usan este antivirus.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-65668] Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate pri…

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-56161] Improper access control in Azure Logic Apps allows an authorized attacker to disclose information ov…

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2025-14561] In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. Thi…

In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is …

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-14829] The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin throug…

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPres…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18969] A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20…

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclo…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-20304] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20304 are related to improper access control issues that are gr…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-20267] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that ar…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16102] A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and acc…

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrati…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2025-70962] Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains ha…

Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-16736] The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's regist…

The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-15230] The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its R…

The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-18788] A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted eleme…

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-59912] Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Ac…

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges and arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-62246] Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a Te…

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or dest…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-66803] Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a ne…

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-58043] A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree pr…

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-16527] An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP…

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-65943] Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

29/07/2026

[CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic S…

Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.3 NVD