Vulnerabilidades — Alertas SI

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100557] OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispat…

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owner status. Non-owner senders authorized to invoke skill commands can access owner-only tools and server credentials reserved for owners.

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100560] OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always a…

OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability where Allow Always approvals for exact commands persist as path-only grants on macOS and Linux. Attackers can reuse the same executable with different arguments to execute commands without triggering new approval prompts, potentially accessing files or internal services.

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100552] OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies …

OpenClaw (npm package 'openclaw') before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a lower-trust conversation was assigned to a Codex runtime and restricted with a per-chat tool allowlist, …

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100535] OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating reque…

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to…

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100530] OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals,…

OpenClaw versions before 2026.8.1 fail to bind working directory context to reusable exec approvals, allowing approved commands to execute in different directories. Attackers with an allow-always approval can reuse it to run the same command against unreviewed files or repositories with materially different effects.

M Alto vulnerabilidad

25/09/2026

[CVE-2026-89032] BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic…

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between _get_semantic_cache_tenant_scope() and _get_metadata_variable_name(). Attackers holding a valid virtual key can submit semantically similar prompts on affected routes su…

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-93643] When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an …

When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes and execute commands as zimbra.

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97818] phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/…

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

M Alto vulnerabilidad

24/09/2026

[CVE-2026-84399] The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based …

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated contex…

M Alto vulnerabilidad

24/09/2026

[CVE-2026-61788] DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to ve…

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it neve…

M Alto vulnerabilidad

24/09/2026

[CVE-2026-94609] authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account…

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from …

M Alto vulnerabilidad

24/09/2026

[CVE-2026-88907] Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This…

Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026.

M Alto vulnerabilidad

24/09/2026

[CVE-2026-57590] A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The …

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96603] A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_lo…

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release syst…

M Crítico vulnerabilidad

23/09/2026

[CVE-2026-85724] Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are config…

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write acce…

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96512] A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restriction…

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by …

M Alto vulnerabilidad

22/09/2026

[CVE-2026-95814] Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-…

Vaultwarden through 1.37.3 omits organization membership status validation from three cipher access-restriction queries, allowing revoked and not-yet-confirmed members to retain read, write, delete, and attachment access to organization ciphers. Attackers with revoked or pending membership can exploit missing status filters in get_user_collections_access_flags, get_group_collections_access_flags, …

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75745] Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that coul…

Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75723] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

M Crítico vulnerabilidad

22/09/2026

[CVE-2026-75728] Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could resu…

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction.

Alertas de Seguridad de la Información

📬 Alertas semanales SI directo en tu email

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?