Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/06/2026

[CVE-2026-56396] phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRig…

phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_superadmin flag or grant arbitrary rights to escalate to SuperAdmin access.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-56341] AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plu…

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-11912] The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insuff…

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() ch…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-48582] Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileg…

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

19/06/2026

[CVE-2026-49291] mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTT…

mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that include mutating tools. A read-only OAuth client can call `store_memory` and `delete_memory` through MCP even though the corresponding REST endpoints require `w…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-12407] The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorizatio…

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path the controller's index_action() nonce gate is bypassed entirely — while reading an attacker-controll…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54810] Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configu…

Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54415] Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS befo…

Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azli…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69189] Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access C…

Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-54802] Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

Unauthenticated Broken Authentication in SMS Alert Order Notifications

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-49081] Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

Unauthenticated Broken Access Control in User Registration Stripe

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-49057] Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

Unauthenticated Broken Access Control in JobSearch

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-40726] Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

Unauthenticated Broken Access Control in User Registration Stripe

nvdaltovulnerabilidad CVSS 8.2 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-28615] In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions byp…

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

17/06/2026

[CVE-2026-24611] Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

Unauthenticated Broken Access Control in MetForm Pro

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2026-22343] Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

Unauthenticated Broken Access Control in WordPress Dating Theme

nvdaltovulnerabilidad CVSS 8.6 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-0071] In SettingsLib, there is a possible missing permission check due to a logic error in the code. This …

In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-0081] In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could …

In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

17/06/2026

[CVE-2025-69103] Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.

Subscriber Arbitrary Content Deletion in Brikk

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2025-48640] In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing…

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 8.0 NVD