Alertas de Seguridad de la Información

M Alto vulnerabilidad

10/09/2026

[CVE-2026-87958] IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where …

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service where a specific functionality on a Db2 server can be disabled by a privileged user under certain conditions.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-75777] IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container p…

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system calls being permitted within the container.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88891] OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing …

OpenPanel fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publish project data. Attackers with explicit read-only access can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules by exploiting missing access level validation …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-88863] capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank aga…

capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite() function of supabase/functions/_backend/private/invite_new_user_to_org.ts. The POST /private/invite_new_user_to_org endpoint only requires the org.update_user_roles permission for org_super_admin invitations, so an authenticated user holding only the o…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-84042] A flaw was found in crun. When crun is built with libkrun and a container is started rootful with pa…

A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-81431] The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form …

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leadi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-87998] Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 un…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, DELETE /api/v1/knowledge/{id}/delete in backend/open_webui/routers/knowledge.py authorized deletion against the knowledge base but then removed its administrator-owned external connection without a separate administrator check or a check for other dependent knowledge bases. A non-adminis…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-14359] The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in …

The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. This is due to the add_user_in_waiting_list() function registered on the wp_ajax_yith_wcwtl_add_user action being missing both a capability check and a nonce verification, and using parse_str() + extract() to import attacker-controlled variables from $_POST['pa…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-75927] The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus…

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-17553] The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and in…

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's bui…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

09/09/2026

[CVE-2026-76801] The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin fo…

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable regex blacklist in Executer::allowedToRun() that fails to block WordPress core functions such as wp_insert_user, update_option, and file_put_c…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

08/09/2026

[CVE-2026-84869] A condition in the ScreenConnect client may allow files to be transferred and executed through an ac…

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58846] In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check…

In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-58874] In multiple functions of SmsController.java, there is a possible escalation of privilege due to a mi…

In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-66818] Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over…

Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

Vulnerabilidad alta en hawtio-operator: acceso no autorizado a Secretos del cluster

Se identificó una falla en hawtio-operator que permite al operador acceder a todos los Secretos del cluster mediante permisos excesivos en ClusterRole (create, get, list, update, watch). El compromiso del pod del operador exponendría credenciales y tokens en todos los namespaces, afectando la seguridad de infraestructuras Kubernetes en producción en México y LATAM. El riesgo es alta (CVSS 8.2) para empresas que despliegan este operador en plataformas cloud o on-premises.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-80166] Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5…

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-14444] The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to…

The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, and who possess the access_key, to create a new u…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta en SureCart (WordPress) permite escalada de privilegios y takeover de cuentas

El plugin SureCart para WordPress en versiones anteriores a 4.6.3 contiene una falla de validación que permite a usuarios con permisos de suscriptor modificar direcciones de correo de otros usuarios, incluidos administradores, y tomar control de sus cuentas mediante reset de contraseña. Esta vulnerabilidad afecta directamente a tiendas en línea y plataformas de comercio electrónico operadas en México y Latinoamérica que usan este plugin.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

06/09/2026

[CVE-2026-86153] A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::Set…

A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.

nvdcriticovulnerabilidad CVSS 9.1 NVD