Alertas de Seguridad de la Información

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en Home Assistant Companion permite ejecución de acciones por aplicaciones no autorizadas

Home Assistant Companion (versiones anteriores a 2026.5.3) no valida correctamente las aplicaciones que envían enlaces de etiquetas NFC o QR a través del sistema operativo, permitiendo que cualquier aplicación no confiable en el dispositivo ejecute acciones arbitrarias en la plataforma de automatización. Esto compromete la privacidad y seguridad local de hogares inteligentes en México y Latinoamérica que dependen de este software de código abierto.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

CVE-2026-66061: Validación insuficiente en Home Assistant iOS permite ejecución de acciones no autorizadas

Home Assistant versiones anteriores a 2026.5.0 presentan una vulnerabilidad alta en la aplicación iOS Companion que permite a aplicaciones no confiables ejecutar acciones mediante enlaces NFC o QR sin validación ni confirmación del usuario. Un atacante podría interceptar o redirigir estas acciones para comprometer dispositivos domóticos, sistemas de control industrial o infraestructura conectada en empresas LATAM. El riesgo es elevado en entornos con múltiples dispositivos IoT altas.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-16041] The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership …

The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores configured to accept reviews only from verified owners.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-16038] The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway …

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de omisión de autenticación en plugin TrueBooker para WordPress

El plugin TrueBooker – Appointment Booking and Scheduler System para WordPress contiene una falla de autorización que permite a atacantes no autenticados cambiar contraseñas de cuentas administrativas en versiones hasta la 1.2.3. Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan WordPress para gestión de citas y reservas, exponiendo el control total de sus sitios web.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica de escalada de privilegios en Microsoft Teams (CVE-2026-65667)

Microsoft Teams presenta una falla de autorización que permite a atacantes no autorizados escalar privilegios sobre la red con puntuación CVSS 10.0. Esta vulnerabilidad afecta directamente a organizaciones en México y Latinoamérica que dependen de Teams para comunicaciones empresariales y colaboración. El impacto potencial incluye acceso no autorizado a datos sensibles, comunicaciones y recursos compartidos dentro del ecosistema corporativo.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

07/08/2026

[CVE-2026-62830] Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a …

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70636] Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated at…

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers can send a POST request to the oauth2-credential refresh route with a trailing credential identifier to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-67621] Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated works…

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert and refresh document store routes to trigger document ingestion, refresh vector database contents, con…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-48085] OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl…

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-account` and creates additional GLOBAL_ADMIN accounts without verifying that an admin already exists. Any unauthenticated network attacker who can submit a same-or…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-48088] OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl…

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without authentication. The handler logs an "Unauthorized crypto key storage attempt" warning when neither …

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-18277] Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 2…

Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66712] Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

Unauthenticated Broken Access Control in Simple Membership

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66708] Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

Unauthenticated Broken Access Control in Total Upkeep

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-66470] Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

Subscriber Broken Access Control in Frontend Admin by DynamiApps

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65554] Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65541] Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

Unauthenticated Broken Access Control in Staff Training

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-65504] Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

Unauthenticated Broken Access Control in BOX NOW Delivery Croatia

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-28140] Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

Unauthenticated Broken Access Control in JetFormBuilder

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-28005] Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer

nvdcriticovulnerabilidad CVSS 9.8 NVD