Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 7 horas

[CVE-2026-78154] A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function…

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeem_invitation_code of the file backend/app/api/routes/v1/user_invitation_code.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing authentication. Remote exploitation of the attack is possible. The project was informed of the pro…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 1 día

[CVE-2026-59808] AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEn…

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the v…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 2 días

Vulnerabilidad alta de bypass de autenticación en Combodo iTop anterior a v3.2.3

Combodo iTop, herramienta web de gestión de servicios de TI, contiene una vulnerabilidad de bypass de autenticación (CVSS 8.6) que permite a atacantes no autenticados ejecutar archivos PHP arbitrarios desde el directorio env-production en instancias nuevas. Afecta altas funciones de ITSM en empresas LATAM. La vulnerabilidad se ha corregido en versión 3.2.3.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-30866] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can ac…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-49217] Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorizati…

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is enabled. Upgrade to Mailu 2024.06.52 to receive a patch or, as a workaround, turn the REST API off.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-55642] dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in c…

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth_middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password_hash is None. A fresh deployment reaches that state when DBX_PASSWORD is unset and no stored password exists, while crates/dbx-web/src/main.rs binds the service to 0.0.0.0 on port 4224 by default. An unauthen…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-18265] OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability al…

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacitor. The issue results from the lack of authentication prior to allowing access t…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-15706] Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry …

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-14952] An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the …

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-76355] In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the informat…

In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could retrieve the information contained in Edge Processor pipeline configurations through a Representational State Transfer (REST) API endpoint when Edge Processor is turned on. The vulnerability does not affect versions prior to 10.4. The vulnerability exists because the Edge Processor service endpoint lacks authentication …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-63722] ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthentic…

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to sk…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-19875] IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email…

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-72529] A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions…

A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 4 días

[CVE-2026-20357] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20357 are related to missing authentication for critical function i…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica en ArcadeDB: autenticación SASL no aplicada en protocolo MongoDB

ArcadeDB versiones anteriores a 26.8.1 no valida credenciales SASL en comandos de datos del plugin MongoDB wire-protocol. Atacantes no autenticados pueden ejecutar inserciones, búsquedas, actualizaciones, eliminaciones y creación de bases de datos conectando al puerto 27017 sin credenciales. Afecta infraestructuras que exponen este servicio en empresas de LATAM con bases de datos sensibles.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 5 días

Vulnerabilidad crítica de autenticación en ArcadeDB anteriores a 26.8.1 (CVE-2026-75854)

ArcadeDB versiones anteriores a 26.8.1 presentan una vulnerabilidad crítica (CVSS 9.8) en el plugin de protocolo Redis que permite a atacantes no autenticados leer, escribir y eliminar datos. Los atacantes pueden conectarse al puerto Redis y ejecutar comandos arbitrarios contra cualquier base de datos del servidor sin proporcionar credenciales. Esta vulnerabilidad afecta especialmente a empresas en LATAM que utilizan ArcadeDB en entornos de producción con acceso a redes inseguras o expuestas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-56677] 9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint i…

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC di…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75479] JimuReport contains an authentication bypass vulnerability in the report folder template listing end…

JimuReport contains an authentication bypass vulnerability in the report folder template listing endpoint that allows unauthenticated attackers to enumerate all reports and retrieve share tokens. Attackers can use disclosed share tokens to access protected report endpoints and retrieve full report definitions including embedded SQL statements and live query data.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-75060] In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP too…

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

Hace 6 días

[CVE-2026-71566] FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware…

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary …

nvdcriticovulnerabilidad CVSS 9.3 NVD