Alertas de Seguridad de la Información

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62194] OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin i…

OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can exploit misconfigured input paths or enabled features to escalate privileges and perform unauthorized actions when the feature is reachable.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-62184] luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IP…

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-62185] Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a…

Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a cluster to access repo-server and other Argo APIs. Attackers can exploit this unrestricted network access through combined attacks to achieve cluster compromise and remote code execution.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62186] OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible…

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62187] OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun…

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62188] OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerabi…

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in v…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-58500] MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on…

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — text, content-desc, resource-id, and locator selector values — directly into an HTML template literal without any HTML or JavaScript context escaping. An attack…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-59801] 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a…

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections to expose partial credenti…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51536] In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network pack…

In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 (a 16-bit signed integer). If a maliciously crafted packet with specific length fields is processed, the length p…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51538] EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability i…

EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability in its handling of encapsulation sessions. When the server processes critical encapsulation commands, it verifies whether the provided session_handle exists in the global session list, but it fails to verify whether that handle belongs to the specific TCP connection issuing the request. Because there…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-51539] A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running …

A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running on Windows. The issue stems from improper timeout management during network read operations.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51540] OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue …

OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue caused by an integer underflow in the processing of connected explicit messages (SendUnitData).

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51541] OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling m…

OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling malformed explicit requests with a forged EPath size. An attacker can send a valid ENIP SendRRData frame carrying a very short CIP payload whose path_size field claims that many more path words are present than are actually available. Because the parser trusts the attacker-controlled path_size and co…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

13/07/2026

[CVE-2026-51821] SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke…

SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacker to execute arbitrary code via the /user/getUserLogin endpoint

nvdcriticovulnerabilidad CVSS 9.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-15685] Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnera…

Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ollama. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloadBlob function. The issue results from the lack of proper validation of user-supplied …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-39042] An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.…

An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten() function in libumsg.so.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15597] A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. T…

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. This affects an unknown function of the file /edit_exam2.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15680] Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerabil…

Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of JSON requests in the sonia binary. Th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15683] Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulne…

Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to exploit this vulnerability. The specific flaw exists within the device management functionality. The issu…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15684] Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerabilit…

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Disk Clean functionality.…

nvdaltovulnerabilidad CVSS 7.3 NVD