Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/07/2026

[CVE-2026-64863] goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, th…

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issue is fixed in version 2.1.4.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62427] [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

27/07/2026

[CVE-2021-32084] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer res…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64737] An authorization issue was addressed with improved state management. This issue is fixed in macOS Se…

An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

nvdaltovulnerabilidad CVSS 8.2 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64738] A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia…

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64702] An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Seq…

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to break out of its sandbox.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-43779] A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8,…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to intercept network connections intended for another process.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43760] An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma…

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data.

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-28945] A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS…

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to bypass network restrictions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/07/2026

[CVE-2026-14235] The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to th…

The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-58630] Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges o…

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-9765] Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. …

Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attac…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

24/07/2026

[CVE-2026-15704] In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vuln…

In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configuration used Chi's `middleware.StripSlashes`, so a request such as `GET /shells/` was dispatched to the registered `GET /shells` route. However…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-14603] The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorizatio…

The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/07/2026

[CVE-2026-35425] Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code…

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-65757] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules An…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2026-64876] Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP ext…

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

23/07/2026

[CVE-2024-58330] A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthentic…

A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data.

nvdaltovulnerabilidad CVSS 7.5 NVD

O Crítico vulnerabilidad

22/07/2026

[CVE-2026-60369] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security…

nvdcriticovulnerabilidad CVSS 9.9 NVD

O Alto vulnerabilidad

22/07/2026

[CVE-2026-60371] Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (componen…

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Platform Security for Java executes to …

nvdaltovulnerabilidad CVSS 8.0 NVD