Alertas de Seguridad de la Información

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53858] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .e…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability where workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots. Attackers can manipulate the STATE_DIRECTORY variable to load runtime dependencies from unintended local paths, potentially executing malicious code during dependency resolution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53849] OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature i…

OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validates Discord account identity using mutable display names instead of immutable user IDs. Attackers with Discord accounts can change their display name to match a policy entry and gain unauthorized agent access intended for another Discord identity.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53853] OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that …

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured argPattern restrictions by directly invoking allowlisted executables with unrestricted arguments, potentially enabling unauthorized file access, network access, or…

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53855] OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operato…

OpenClaw before 2026.4.2 contains an inline-eval bypass vulnerability allowing authenticated operators to weaken strict allowlist checks via shell positional parameters. Attackers can combine allowlisted tools with shell positional arguments to place inline-eval content in shell carriers outside intended allowlist rules, enabling execution of unapproved shell-provided content.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53842] OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace…

OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to influence Python runtime selection through CLOUDSDK_PYTHON during Gmail setup gcloud execution. Attackers with repository access can manipulate the CLOUDSDK_PYTHON variable to execute setup through unintended local Python paths, potentially enabling arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53843] OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-s…

OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device session can re-establish node token authority after revocation. Attackers with a paired device can regain WebSocket node-level access without renewed approval, weakening revocation controls and maintaining unauthorized access longer than intended.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53846] OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows …

OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env files to override the npm_execpath configuration used for bundled runtime dependency installation. Attackers with workspace access can execute unintended local package-manager executables during dependency setup to compromise the build environment.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53840] OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP se…

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-50656] Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Micros…

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

16/06/2026

[CVE-2026-47964] DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability t…

DNG SDK versions 1.7.1 2536 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

16/06/2026

[CVE-2026-47749] stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wa…

stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Versions prior to master-584-0a7ae07 are vulnerable to heap buffer overflow in SHORT_BINUNICODE parsing for PyTorch checkpoint files. The pickle .ckpt parser in src/model.cpp contained a heap buffer overflow vulnerability in the SHORT_BINUNICODE opcode ha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-39575] update_disk_psu_baseline.sh requires password in plain text

update_disk_psu_baseline.sh requires password in plain text

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-42089] Yeoman Environment provides an API to discover, create, and run generators, and to configure where a…

Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass attacker-controlled project configuration into this path, this can result in arbitrary package install…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-44932] Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 co…

Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24155] NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploi…

NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, and data tampering.

nvdaltovulnerabilidad CVSS 7.8 NVD

N Alto vulnerabilidad

16/06/2026

[CVE-2026-24228] NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization…

NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, data tampering, and information disclosure.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2025-71261] An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE H…

An attacker with network-level access between the SUSE Virtualization and Rancher Manager in SUSE Harvester before 1.8.0 could interfere with the TLS handshake and abuse it to bypass TLS as a security control.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-10649] A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vu…

A flaw was found in Pacemaker. An unauthenticated remote attacker can exploit an integer overflow vulnerability in the remote message decompression process. By sending a specially crafted compressed remote message before authentication, an attacker can cause memory corruption, leading to a denial of service (DoS) in the CIB remote listener. This can result in the affected service crashing.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-24909] Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vul…

Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated user could potentially exploit this vulnerability to escalate privileges. The malicious user may gain the ability to run arbitrary code remotely. This is a high severity vulnerability so Dell recommends customers to upgrade at the earliest opp…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

nvdaltovulnerabilidad CVSS 7.0 NVD