Alertas de Seguridad de la Información

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62196] OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where What…

OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62190] OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper…

OpenClaw versions before 2026.6.9 contain an authorization bypass vulnerability in the flock wrapper that allows lower-trust callers to execute or persist actions beyond their intended authorization. Attackers can leverage configured input paths to bypass durable exec approval binding and perform unauthorized operations when the affected feature is enabled.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62191] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip requester authorization and execute privileged operations when the affected feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62192] OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord …

OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in Discord guild actions that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to skip cross-provider requester authorization and execute restricted operations.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62186] OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible…

OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to perform actions requiring stronger authorization checks. Attackers can exploit misconfigured input paths to bypass admin authorization policies and execute restricted operations.

nvdaltovulnerabilidad CVSS 7.6 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62187] OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun…

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62188] OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerabi…

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check. The issue is fixed in v…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15541] A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.…

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the component Master Websocket Handler. Executing a manipulation of the argument Agent can lead to missing authorization. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

11/07/2026

[CVE-2026-1359] The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modifi…

The Genolve – AI image AI video generation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the genolve_setOpt() function in all versions up to, and including, 5.0.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary WordPress options, including enabling user registration and …

nvdaltovulnerabilidad CVSS 8.8 NVD

B Alto vulnerabilidad

10/07/2026

[CVE-2026-57215] RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ …

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and…

nvdaltovulnerabilidad CVSS 8.8 NVD

S Alto vulnerabilidad

10/07/2026

[CVE-2026-55460] Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user w…

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, an authenticated non-admin user with users.view and users.edit but without users.delete can directly POST to /users/bulksave with delete_user=1 because BulkUsersController::destroy() authorizes only update, allowing the user to soft-delete another non-admin user. This issue is fixed in version 8.6.2.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55672] ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2…

ZITADEL is an open source identity management platform. Prior to 3.4.12 and 4.15.2, ZITADEL's OAuth2 and OIDC CodeExchange, RefreshToken, and device token flows fail to verify that the requesting client matches the client that initiated the authorization flow, allowing intercepted grants or refresh tokens to be exchanged under a different client. This issue is fixed in versions 3.4.12 and 4.15.2.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-55638] 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /…

9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider crede…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-39903] Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an author…

Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8 contains an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php where a single-character operator error causes the permission check to always pass regardless of user permissions. An authenticated low-privileged user can approve, reject, or delete any pending attachments on any board without ho…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-22659] FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that …

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-40452] Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass…

Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: from 1.3.5 before 1.3.8, from 2.0.5 before 2.0.10. Users are recommended to upgrade to version 2.0.10, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15125] Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote atta…

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

08/07/2026

[CVE-2026-35210] OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.…

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability in OpenCTI allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header, enabling attackers to downgrade confid…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-54652] Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} end…

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified.

nvdaltovulnerabilidad CVSS 8.1 NVD

N Alto vulnerabilidad

08/07/2026

[CVE-2026-56776] n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor…

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real evaluation test run, causing the workflow to execute via the internal workflow runner and resulting in unin…

nvdaltovulnerabilidad CVSS 7.4 NVD