Alertas de Seguridad de la Información

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92466] zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where th…

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. Authenticated users with no roles can access administrative APIs including user management, role assignment, and Elasticsearch index operations by bypassing the disabled authorizati…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/09/2026

Vulnerabilidad de autorización en yshop-crm 2.1.3 expone políticas de reciclaje de clientes

yshop-crm versiones hasta 2.1.3 no valida permisos en los endpoints saveRedisSet y getRedisSet del controlador CrmCustomerController, permitiendo que usuarios autenticados del back-office lean y modifiquen políticas altas de asignación de leads y reciclaje automático de clientes a nivel de instalación. Empresas en LATAM que usan esta plataforma de CRM enfrentan riesgo de manipulación masiva de datos de clientes y comportamientos de negocio automatizados mediante modificación de claves Redis compartidas.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Crítico vulnerabilidad

16/09/2026

[CVE-2026-14349] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to auth…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92299] @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an…

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-73807] The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functi…

The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

15/09/2026

[CVE-2026-66887] The affected products are missing authorization on state-changing CGIs and session checks are not pe…

The affected products are missing authorization on state-changing CGIs and session checks are not performed.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-56825] Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-56827] Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/s…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages re…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-56829] Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components…

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product varian…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91929] Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that f…

Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-88619] 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job mana…

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-54076] ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA a…

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, while the remaining public schema mutators in engine/src/main/java/com/arcadedb/schema/LocalDocumentType.java and engine/src/main/java/com/arcadedb/schema/LocalProperty.java remained unchecked. An authenticated identity, including a read-o…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-55178] GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map …

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a relationship, map layer, VRT source, externalId lookup, or request body. When a public map references a private…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en pgweb 0.17.0 permite acceso no autorizado a bases de datos

pgweb versiones hasta 0.17.0 contiene una vulnerabilidad en el endpoint POST /api/connect que permite a atacantes eludir la autorización cuando connect-backend está configurado, proporcionando cadenas de conexión arbitrarias a bases de datos. Los atacantes pueden acceder a bases de datos no autorizadas y servicios internos manipulando identificadores de sesión y URLs de conexión, afectando especialmente infraestructuras de datos en empresas mexicanas y latinoamericanas con configuraciones de autorización insuficientes.

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en PraisonAI permite ejecución no autorizada de herramientas (CVE-2026-57137)

PraisonAI versiones 1.4.0 a 1.7.2 contienen una falla de control de acceso en createAgentLoop() que ejecuta herramientas antes de validar permisos. Un atacante puede forzar la ejecución de funciones no autorizadas que generen efectos secundarios irreversibles, comprometiendo sistemas de IA generativa en empresas mexicanas y latinoamericanas. El CVSS 8.8 refleja impacto alto en confidencialidad e integridad de datos.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

15/09/2026

Vulnerabilidad crítica en PraisonAI permite ejecución remota sin autenticación (CVE-2026-57139)

PraisonAI versiones 1.5.0 a 1.7.2 contienen una falla de seguridad crítica (CVSS 9.8) en MCPServer.startHttp() que expone funciones de herramientas, recursos y prompts sin validación de autenticación. Cualquier cliente en red con acceso al puerto puede ejecutar comandos arbitrarios en sistemas que utilicen esta plataforma de agentes múltiples, afectando servidores en producción en México y Latinoamérica que procesen datos sensibles.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

15/09/2026

Vulnerabilidad alta en PraisonAI permite ataques de DNS rebinding en sistemas locales

PraisonAI (versiones 0.6.0 a 1.6.59 en praisonaiagents y 3.10.0 a 4.6.59 en PraisonAI) expone endpoints legados /sse y /messages/ sin validación de Host, Origin ni autenticación, permitiendo que sitios maliciosos ejecuten ataques de DNS rebinding contra instancias locales. Afecta especialmente a empresas que ejecutan sistemas multi-agente en infraestructura interna o en la nube privada. El CVSS de 8.3 refleja alto riesgo de compromiso de datos y control remoto.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-43689] A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and …

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A malicious app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54628] Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-…

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provide a loopback, private-network, or link-local cloud metadata URL, causing go-getter in the Anyquery s…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-54629] Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file…

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without authentication, authorization, or directory restrictions. A remote attacker can use SQLite CREATE VIRTUAL TABLE statements to provide a local path to these modules, which use hashi…

nvdaltovulnerabilidad CVSS 7.5 NVD