Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105072] Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-97303] Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-g…

Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-45524] In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permiss…

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-105635] Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/wor…

Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-104979] Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in …

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new user with no workspace memberships, can plant arbitrary HTML in a project that has a published DeployBoard with intake enabled. When a projec…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-104971] Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a so…

Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEndpoint omit workspace authorization, allowing authenticated users to read, create, modify, or delete assets in workspaces where they are not …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

Hace 5 días

[CVE-2026-105209] ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: wh…

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorization vulnerability: when issuing passkey or passwordless enrollment codes, it checks only the organization in the x-zitadel-orgid header, not the target user's organization. Attackers with user-write permission in one organization can obtain an enrollment code for a user in another organization on the same instance and r…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad de omisión de autorización en plugin Nelio Content para WordPress (CVE-2026-94505)

El plugin Nelio Content – Editorial Calendar & Social Media Auto-Posting para WordPress es vulnerable a omisión de autorización en versiones hasta 4.5.0. Atacantes autenticados con acceso de contribuidor pueden eliminar permanentemente contenido de redes sociales reutilizables. Afecta especialmente a agencias de marketing digital y empresas de comunicación en LATAM que usan WordPress con este plugin.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/10/2026

Vulnerabilidad alta en Simple Membership para WordPress permite modificación no autorizada de datos

El plugin Simple Membership para WordPress (versiones hasta 4.8.3) contiene una vulnerabilidad que permite a atacantes no autenticados modificar datos y acceder a información sensible a través de los endpoints resend-activation y email-activation. La falta de validación de autenticación, nonce y permisos en estas funciones expone a miles de sitios WordPress en LATAM que utilizan este plugin gratuito para gestionar membresías.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-101923] The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion i…

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public review submission into the review's reviews-images comment meta without verifying that the IDs correspond to attachments owned by the submitter,…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/10/2026

[CVE-2026-93428] The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Mem…

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted memb…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-82041] UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocke…

UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped to the /command/{hostname} STOMP destination, where no role check or command allowlist is applied before forwarding supplied commands. Any authenticated user, regardless of role, can send arbitrary operating-system commands over gRPC to any connected agent, res…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104991] Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API i…

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentiality control by never invoking the allowAccess() authorization routine. Attackers can use a valid API key to read restricted issue contents a…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-101104] The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows auth…

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad alta de autorización en YesWiki anterior a 4.6.7 expone archivos confidenciales

YesWiki versiones anteriores a 4.6.7 contienen una falla de autorización en el manejador de descargas que permite a atacantes no autenticados eludir controles de acceso (ACLs) y descargar archivos adjuntos de páginas restringidas. Esta vulnerabilidad afecta principalmente a organizaciones en LATAM que utilizan wikis internas para gestión documental, exponiendo información sensible como reportes, datos financieros y documentación confidencial sin requerir credenciales válidas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

Vulnerabilidad alta de bypass de autorización en YesWiki anterior a 4.6.7

YesWiki versiones anteriores a 4.6.7 contiene un defecto de autorización en ApiService::isAuthorized() que permite a atacantes no autenticados invocar rutas API administrativas cuando el modo API público está habilitado. Los atacantes pueden modificar configuraciones, acceder y eliminar archivos de respaldo mediante endpoints como api/ci/update_config y api/archives, comprometiendo la integridad y disponibilidad de wikis empresariales en LATAM.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-104410] SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to …

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-94541] The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization b…

The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to exfiltrate password-reset URLs for arbitrary users, including administrators, mirrored into the p…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97277] Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

Subscriber Broken Access Control in Social Boost

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-97297] Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

Subscriber Broken Access Control in Gratisfaction

nvdaltovulnerabilidad CVSS 7.6 NVD