Alertas de Seguridad de la Información

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54311] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow persist into subsequent Merge SQL…

nvdaltovulnerabilidad CVSS 7.7 NVD

N Alto vulnerabilidad

23/06/2026

[CVE-2026-54312] n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with perm…

n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing application-wide validation failures and rende…

nvdaltovulnerabilidad CVSS 8.5 NVD

N Crítico vulnerabilidad

23/06/2026

[CVE-2026-54310] n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated use…

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixe…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-10521] An high privileged remote attacker can access a hidden configuration method, that should not be acce…

An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.

nvdaltovulnerabilidad CVSS 7.2 NVD

A Alto vulnerabilidad

22/06/2026

[CVE-2026-50269] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, att…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may b…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-56424] MISP core contained multiple broken access-control flaws where authorization checks were performed a…

MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability checks were missing on write paths. In affected subsystems, a lower-privileged authenticated user with the relevant feature permission could cause the application to authorize one object but mutate another, or could modify objects that were mer…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-11912] The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insuff…

The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and modify files on the serve. This vulnerability is exploitable even when the administrator has not enabled the AllowFrontManage setting, because the is_admin() ch…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

20/06/2026

[CVE-2026-56215] Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbi…

Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts as an account-merge key. Attackers can pre-position their account with a victim's corporate SSO email, causing the provision-user endpoint to merge the victim's SSO identity into the attacker-controlled account.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-56081] Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and cont…

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-le…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

19/06/2026

[CVE-2026-56073] Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allo…

Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.

nvdcriticovulnerabilidad CVSS 9.4 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-11395] The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions…

The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull_the_trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Exploitation requires that the admin-co…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-22312] The device has a webserver that exposes a REST API authenticated with a constant token. The unauthen…

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

nvdaltovulnerabilidad CVSS 8.6 NVD

C Medio vulnerabilidad

16/06/2026

[CVE-2026-48775] LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (b…

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond w…

check-pointcheckpointmedio CVSS 6.8 NVD

D Alto vulnerabilidad

16/06/2026

[CVE-2026-12161] Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permis…

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-50875] Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows aut…

Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modify or delete another tenant's webhook via a crafted request.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2016-20084] WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities…

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScript into the 'ict' and 'ics' options or the calendar 'name' parameter via GET requests to execute arbitra…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2019-25746] WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows au…

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send requests to the admin.php endpoint with action=duplicate_quote_invoice and malicious 'post' values to extract sensitive database information or modify data.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53831] OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowli…

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47366] Improper verification of access permissions when modifying permissions through the Administration Co…

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

nvdaltovulnerabilidad CVSS 7.2 NVD