Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/07/2026

[CVE-2026-62231] The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API key…

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.6 contains an authorization bypass: API keys can be created with a restricted scopes array, but the ApiKeyAuthenticator class never reads or enforces these scopes. It loads and returns the owning user's full account object, so a key created with limited scopes (e.g. read-only) can perform any write, delete, or administrative operation the ow…

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62223] OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval …

OpenClaw before 2026.5.18 contain an authorization bypass vulnerability in the device-pair approval feature that allows lower-trust callers to execute actions beyond their intended authorization. Attackers can exploit misconfigured input paths to execute or persist unauthorized actions when the affected feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62217] OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals…

OpenClaw 2026.5.14-beta.1 before 2026.5.27 contain an authorization flaw in the QQBot exec approvals feature. When the feature is enabled and reachable, a lower-trust caller or configured input path could execute or persist actions beyond the caller's intended authorization, allowing non-allowlisted senders to perform unauthorized operations.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62219] OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allow…

OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allowedAgentIds validation. A lower-trust caller or configured input path can bypass agent ID restrictions by submitting blank agent IDs, allowing actions that should require stronger authorization or policy checks.

nvdaltovulnerabilidad CVSS 7.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62209] OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack…

OpenClaw versions 2026.5.10-beta.1 before 2026.6.5 contain an authorization bypass in the ClickClack agent-mode dispatch feature, which could ignore the toolsAllow policy check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could perform actions that should have required a stronger authorization or policy check.

nvdaltovulnerabilidad CVSS 8.1 NVD

O Alto vulnerabilidad

17/07/2026

[CVE-2026-62202] OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated …

OpenClaw versions 2026.6.1 before 2026.6.9 contain a privilege escalation vulnerability in isolated cron jobs that allows lower-trust callers to regain denied execution tools. Attackers can execute or persist actions beyond their intended authorization by leveraging misconfigured input paths in the affected cron feature.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-43977] wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated…

wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability exists in RoutineViewSet (wger/manager/api/views.py). The view defines two custom actions /logs/ and /stats…

nvdaltovulnerabilidad CVSS 7.5 NVD

L Alto vulnerabilidad

16/07/2026

[CVE-2026-62290] cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and…

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace users without admission validation tying the Challenge to an Order, owner reference, or Issuer-selecte…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-63085] Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that…

Axelor Open Platform versions 8.x prior to 8.2.2 contains an authorization bypass vulnerability that allows authenticated non-admin users to escalate privileges by exploiting unenforced field restrictions on nested relational save operations. Attackers can modify sensitive User record fields such as roles and group by submitting changes through a related entity's save path, bypassing the USER_REST…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-59258] immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:user…

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

nvdaltovulnerabilidad CVSS 8.3 NVD

B Alto vulnerabilidad

15/07/2026

[CVE-2026-53515] Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11,…

Better Auth is an authentication and authorization library for TypeScript. From 1.2.10 until 1.6.11, the @better-auth/sso plugin's POST /sso/register endpoint lets any organization member attach a new SSO provider to that organization because registerSSOProvider checks only for a membership row and does not require an owner or admin role, allowing attacker-controlled OIDC or SAML providers to driv…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-55242] ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, …

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-61644] FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api…

FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, the POST /api/core/chat/record/getCollectionQuote endpoint authenticates the caller's chat and collection context, but the initialId center-node lookup is not bound to that authorized context. A low-privileged tenant user can call the endpoint with valid attacker-owned appId, chatId, chatItemDataId, and collecti…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54563] Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV a…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, a Cloudreve WebDAV account rooted at a configured folder can send paths such as /dav/%2e%2e/outside.txt because stripPrefix in pkg/webdav/webdav.go joins the decoded request suffix to the account root with fs.URI.JoinRaw without checking containment, allowing the scoped credential to read and list files outside the con…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

15/07/2026

[CVE-2026-54560] Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's…

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as fi…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15752] A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f92…

A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/users/ of the component Backend User Endpoint. Performing a manipulation results in missing authorization. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to…

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-49981] Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all…

Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 8.2 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48808] Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st…

Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50528] Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a …

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

nvdaltovulnerabilidad CVSS 8.2 NVD

S Alto vulnerabilidad

14/07/2026

[CVE-2026-48489] Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Pr…

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped f…

nvdaltovulnerabilidad CVSS 7.5 NVD