Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/08/2026

[CVE-2026-72810] SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast…

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73842] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and …

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any network-reachable caller to read tenant Kubernetes Secrets, mutate workloads, and execute commands across connected…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73843] OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, i…

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods i…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73658] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResourc…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-73305] Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal…

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73656] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predica…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72675] Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unautho…

Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning fu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72665] Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic …

Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evaluate Elastic Security detection rules can cause response actions to be carried out against enrolled agents without holding the Osquery live que…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-72669] The state that Kibana stores for an Observability Onboarding flow is not bound to the user who creat…

The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-59714] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 bef…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_chann…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-73653] Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Br…

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWrite permission gate or confining paths to the project root. A client that can reach the Browser Mode API…

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66469] Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

Unauthenticated Broken Access Control in Arvow AI SEO Writer

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66461] Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66466] Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Up…

Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66431] Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLIN…

Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-66441] Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

Unauthenticated Broken Access Control in MultiVendorX

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-61984] Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

Unauthenticated Broken Access Control in WPMobile.App

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28186] Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Subscriber Broken Access Control in Travelfic Toolkit

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28188] Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Unauthenticated Broken Access Control in Hydra Booking

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-28173] Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

Customer Arbitrary Content Deletion in WP Event SOlution

nvdaltovulnerabilidad CVSS 7.1 NVD