Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-61925] Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges loc…

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-25652] is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A…

is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72921] SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go a…

SeaweedFS is a distributed storage system. Prior to 4.24, the weed/server/filer_server_handlers.go allowed_prefixes authorization check used strings.HasPrefix on raw path strings, so a filer JWT scoped to /tenant1 also authorized sibling paths such as /tenant1234, /tenant1-old, and /tenant1backup, enabling cross-tenant reads and writes with a valid scoped token. This issue is fixed in version 4.24…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-18635] Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user …

Velociraptor's VQL has a query() plugin which allows running a VQL query in a different org or user context. To be able to run as a different user, the calling user needs to have the IMPERSONATE permission (usually only given to administrators). Velociraptor versions prior to 0.77.2 evaluate this permission against the caller's org instead of against the target org. This allows an administrator i…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72886] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.c…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.2 until 0.29.13, schedule.create and schedule.update in apps/dokploy/server/api/routers/schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch, allowing a member with access to one application to attach its applicationId to a dokploy-server sc…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-69118] Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template re…

Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achieving remote code execution as the web server process.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-7867] A flaw was found in udisks2. A local attacker with an active console session can exploit insufficien…

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation th…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-45414] Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2,…

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read participantDetails data and reach the proposal.answer mutation path. This issue is fixed in versions 0.31.5 and 0.32.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

06/08/2026

Vulnerabilidad de autorización faltante en TinyAGI 0.0.20 permite acceso remoto no autorizado

Se ha detectado una vulnerabilidad de seguridad en TinyAGI versión 0.0.20 que afecta la función processMessage del componente Message API Endpoint. La falla permite eludir controles de autorización y ejecutar acciones remotas sin validación de permisos. El exploit ha sido divulgado públicamente, aumentando el riesgo de explotación inmediata en entornos de producción en Latinoamérica que utilicen esta versión.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-52466] Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The appl…

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to the requested function. The requester receives a response indicating that access was denied, but the act…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-71315] Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mi…

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta de autenticación en Documize Community permite acceso no autorizado a archivos

Documize Community contiene una falla de autenticación en su ruta de descarga de adjuntos que permite a atacantes eludir completamente la autenticación usando cualquier valor no vacío en el parámetro 'secure'. Esto expone documentos y archivos confidenciales en empresas que utilizan esta plataforma para gestión de contenido. Con CVSS 7.5, afecta significativamente la confidencialidad de datos en organizaciones mexicanas y latinoamericanas que almacenan información sensible en Documize.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-70494] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in backend/open_webui/routers/folders.py allowed a user granted write access to a shared chat folder to permanently delete chats and messages belonging to the folder owner. The cascade following the authorization check is bound to the folder owner'…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

03/08/2026

[CVE-2026-48333] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

02/08/2026

[CVE-2026-68581] Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. B…

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a link-share JWT whose numeric ID equals a target user's ID is treated as that user by the /api/v1/tokens endpoints. An authenticated attacker can obtain a target's num…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica en ArcadeDB anterior a 26.7.2 permite ejecución arbitraria de código JavaScript

ArcadeDB versiones anteriores a 26.7.2 no validan correctamente permisos de scripting en sentencias SQL DEFINE FUNCTION con lenguaje JavaScript, permitiendo que usuarios con acceso a la base de datos ejecuten código malicioso y eludir controles de seguridad. Este fallo afecta principalmente a empresas en LATAM que utilizan ArcadeDB para aplicaciones críticas sin actualizar regularmente. El CVSS 9.8 indica riesgo crítico que requiere atención inmediata.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-18394] Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow re…

Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users should upgrade to version 0.8.2.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-55502] Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/p…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-48449] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-18255] A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot acc…

A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account.

nvdaltovulnerabilidad CVSS 7.2 NVD