Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55065] Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api…

Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated user to supply a view identifier from another project while authorizing only against an attacker-controlled project identifier. ProjectView.CanDelete in pkg/models/project_view_permissions.go does not establish that the view belongs to the p…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/08/2026

[CVE-2026-55066] Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/project…

Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the vict…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad en CodeMeter Runtime permite falsificación de sesiones y acceso a licencias

CodeMeter Runtime versiones anteriores a 8.41a y 9.10, cuando se configura como servidor, genera identificadores de sesión (SID) criptográficamente débiles que pueden ser forzados por ataque de fuerza bruta. Un atacante podría recuperar números de handle de otras sesiones y leer información de licencias, comprometiendo la integridad de sistemas de gestión de licencias en empresas de manufactura, software y servicios profesionales en LATAM.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-77368] SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resu…

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their own token forbids. The HEAD, PATCH, and DELETE verbs that act on an existing session by its id never ve…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-55228] Weblate is a web-based continuous localization platform used to manage software translations. In ver…

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-scoped teams, allowing a user to submit invalid team configurations through the API. By assigning projects to a team via these unvalidated requests, a user could grant access to projects they were not au…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/08/2026

[CVE-2026-81031] IDURAR ERP CRM changes the password of whichever account a request names rather than the account mak…

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controllers/middlewaresControllers/createUserController/updatePassword.js resolves the authenticated user from the request that the token middleware populated, then issues its update against a filter built from the identifier in the URL path, and ne…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-80049] Airbyte Platform resolves the workspace used for its authorization decision from a field the caller …

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destinati…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71505] Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API th…

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password throu…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-76073] Label Studio does not scope the annotation detail endpoint to the requesting user's organization. An…

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and lab…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78203] Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, …

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-62283] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezh…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/08/2026

Vulnerabilidad crítica en proxy LLM de Headroom permite suplantación de usuarios

Headroom's LLM proxy contiene una vulnerabilidad de autenticación insuficiente (CVSS 9.1) en el encabezado x-headroom-user-id que permite a atacantes acceder y modificar datos de memoria de otros usuarios sin autorización. El fallo afecta rutas de chat completion y websocket en headroom/proxy/handlers/openai.py. Empresas que usan este proxy para gestionar modelos de lenguaje corren riesgo de exposición de datos sensibles y suplantación de identidad.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-69558] Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized …

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76397] In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and…

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including data associated with other users. The vulnerability is possible because Splunk AI Toolkit does not preserve the trusted experiment scope when it processes caller-controlled query values before accessing restricted history data. For more info…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53548] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/password endpoint in src/backend/database/routes/host.ts accepts an authenticated user's numeric host ID and the field=password or field=sudoPassword query without enforcing host ownership during credential resolution. A failed requester-scoped loo…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-53546] Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capa…

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When no credential is shared with the requester, resolveHostById performs an owner credential fallback, and…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-18315] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Auth…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Account Takeover in all versions up to, and including, 1.2.6. This is due to the admin_user_create_cus AJAX handler lacking any authentication or capability check before passing the attacker-supplied truebooker_wp_user_id parameter directly to …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-62666] Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's cont…

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling user mutation endpoints. A non-super account with api.users.write can mint an API key bound to an access.api.super target through requireApi…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76216] Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals…

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete victim bot users, or read team rosters by exploiting id collisions in the autoincrement space.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-14861] The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request …

The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied user, nor bind the protecting token to that user, allowing unauthenticated attackers to reset arbitrary users' email-verification status and lock them, including administrators, out of their accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD