Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100663] Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not spe…

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT trusted.example:443") is parsed as a URI, so its host is emitted as :scheme, :path is set to "/", and the HTTP/1 Host head…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100664] Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds t…

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the r…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100666] Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and…

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100656] Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServ…

Netty (io.netty:netty-codec-http) contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to methodOverflowQueue, an ArrayDeque with no size limit and no rejection path. A remote, unauthenticated attacker who …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100642] SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the …

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative a…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100646] SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3,…

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cr…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100627] Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw i…

Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermission(c, 'channel.promote_bundle', { appId: body.app_id }) and omits the request's channel_id. Because the omitted scope field is passed t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-96524] The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress …

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en paquete OpenClaw (npm) permite falsificación de aprobaciones

OpenClaw versiones anteriores a 2026.7.1 presenta un defecto en el enlace de reacciones de aprobación en Signal que permite que una aprobación destinada a una solicitud estructurada se adjunte incorrectamente a mensajes de texto ordinarios en la misma conversación. Esto podría resultar en que una reacción de un aprobador a un mensaje no relacionado sea interpretada como aprobación de una solicitud, comprometiendo controles de autorización en flujos de trabajo altas de empresas que utilizan esta dependencia npm.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en paquete npm OpenClaw permite bypass de autorización de propietario

OpenClaw (paquete npm `openclaw`) anterior a versión 2026.7.1 no valida correctamente permisos de propietario en solicitudes de autorización de Claude Code a través del canal MCP. Un usuario autorizado sin permisos de propietario puede aprobar o denegar solicitudes de permisos destinadas al administrador de la cuenta, ejecutando acciones sin consentimiento del propietario. Afecta sistemas de automatización y desarrollo que dependan de este paquete en entornos empresariales.

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en OpenClaw Codex permite ejecución remota de código sin autorización

OpenClaw Codex anterior a versión 2026.7.1 presenta falla en validación de autorización que permite a usuarios no propietarios con acceso a comandos crear enlaces nativos y ejecutar operaciones con acceso a archivos, herramientas y procesos del sistema. Afecta principalmente a empresas que utilizan esta plataforma para orquestación de infraestructura en entornos cloud de LATAM.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en paquete npm OpenClaw permite eludir restricciones administrativas (CVE-2026-100588)

OpenClaw versiones anteriores a 2026.7.1 no valida correctamente permisos administrativos en el método node.invoke, permitiendo a usuarios con permisos de escritura acceder a funciones de control de navegador sin autorización. En arquitecturas Gateway que validan identidad del llamante, esto expone sistemas a escalación de privilegios no autorizada.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad alta en OpenClaw (npm) permite escalación de privilegios en Gateway

OpenClaw versiones anteriores a 2026.7.1 expone herramientas administrativas restringidas (gateway y cron) a través del endpoint chat.send, permitiendo que usuarios sin permisos de propietario ejecuten operaciones privilegiadas en despliegues con autenticación. Afecta principalmente a infraestructuras en nube que utilizan este paquete npm en sistemas de orquestación y automatización.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

Vulnerabilidad de suplantación de identidad en OpenClaw (npm) permite escalación de privilegios

El paquete npm 'openclaw' anterior a versión 2026.7.1 presenta una falla alta en la validación de identidad del solicitante en arquitecturas de Gateway con autenticación. Un atacante con permisos de escritura puede suplantar la identidad de otros usuarios para ejecutar acciones de canal no autorizadas. Afecta principalmente a sistemas de integración empresarial en entornos cloud y on-premise en LATAM.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100558] OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listene…

OpenClaw versions before 2026.8.1 contain a resource exhaustion vulnerability in the Gateway listener that allows unauthenticated clients to retain response sockets by sending WebSocket upgrade requests without matching connection semantics. Attackers can repeatedly send malformed upgrade requests to exhaust listener resources and cause denial of service without consuming the WebSocket pre-auth co…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100535] OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating reque…

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100532] @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel…

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and ca…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-91765] cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. A…

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-100391] MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy rou…

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-49850] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an…

nvdaltovulnerabilidad CVSS 7.5 NVD