Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en paquete npm OpenClaw permite bypass de autorización de propietario

OpenClaw (paquete npm `openclaw`) anterior a versión 2026.7.1 no valida correctamente permisos de propietario en solicitudes de autorización de Claude Code a través del canal MCP. Un usuario autorizado sin permisos de propietario puede aprobar o denegar solicitudes de permisos destinadas al administrador de la cuenta, ejecutando acciones sin consentimiento del propietario. Afecta sistemas de automatización y desarrollo que dependan de este paquete en entornos empresariales.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en OpenClaw anterior a 2026.7.1 permite ejecución de código arbitrario

OpenClaw versiones anteriores a 2026.7.1 presentan un defecto de validación de autorización en el comando de instalación Codex que permite a usuarios sin permisos instalar plugins arbitrarios y ejecutar procesos MCP con privilegios de OpenClaw. Esta vulnerabilidad compromete confidencialidad, integridad y disponibilidad de sistemas host, afectando servidores en entornos empresariales de México y Latinoamérica que utilicen esta plataforma.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en OpenClaw Slack 2026.8.0 y anteriores permite bypass de políticas de remitentes

OpenClaw Slack versiones anteriores a 2026.8.1 no validan correctamente las listas de remitentes autorizados en mensajes directos grupales, permitiendo a participantes no autorizados activar agentes de Slack y acceder a herramientas y datos. Esta falla de control de acceso afecta principalmente a organizaciones en LATAM que utilizan automatización de Slack para gestionar datos sensibles, cumplimiento normativo y comunicaciones altas.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100544] openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic in…

openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured agent for classic inbound voice calls without propagating the caller's identity or non-owner status. As a result, owner-only tool filtering can fail open and expose the agent's normal tool authority to a remote caller. A caller who is admitted by the configured inbound-call policy (open, pairing, or allowlist) on a dep…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100532] @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel…

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and ca…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

Vulnerabilidad alta en plugin Modula Image Gallery permite eliminación arbitraria de archivos en WordPress

El plugin Modula Image Gallery para WordPress (versiones ≤3.0.2) contiene una falla de validación de rutas en la función upload_image que permite a usuarios autenticados con acceso de autor o superior eliminar archivos arbitrarios del servidor. Afecta principalmente a sitios web corporativos, e-commerce y portales informativos en LATAM que utilizan este plugin para gestionar galerías de imágenes.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

Vulnerabilidad en plugin Modula Image Gallery para WordPress expone galerías privadas

El plugin Modula Image Gallery (versiones hasta 3.0.1) para WordPress contiene una falla de control de acceso que permite a atacantes acceder a galerías privadas sin autorización. La función Modula_Meta::add_metas() no valida el estado de publicación de las galerías, permitiendo divulgación no autorizada de contenido mediante parámetros GET. Afecta sitios WordPress en empresas y medios de LATAM que almacenan contenido sensible en galerías privadas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-77293] TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:…

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any tri…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-91160] OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSoc…

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-63203] Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0,…

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/m…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-92470] GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 bef…

GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-96603] A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_lo…

A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release syst…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-95604] Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

Unauthenticated Broken Access Control in Loops & Logic

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-95513] Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita…

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76648] CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get…

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'read', obj) — but post() (lines 1001–1010) does not. POST only checks: can_access(model, 'add', create_kwargs_check) can_access(model, 'copy_related', obj) For J…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76086] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integra…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76087] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous form…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hij…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-76089] Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-no…

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs an…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-18177] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execut…

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

23/09/2026

Vulnerabilidad alta en Pake: acceso IPC no restringido expone aplicaciones Tauri

Pake, herramienta que convierte sitios web en aplicaciones de escritorio basadas en Tauri, genera aplicaciones que heredan configuraciones inseguras que otorgan acceso IPC (Inter-Process Communication) a cualquier origen HTTPS mediante un patrón comodín. Esta vulnerabilidad permite que contenido web no confiable ejecute funcionalidad nativa del sistema, afectando potencialmente a empresas en LATAM que distribuyen aplicaciones generadas con Pake sin validar sus configuraciones de seguridad.

nvdaltovulnerabilidad CVSS 8.2 NVD