Alertas de Seguridad de la Información

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100535] OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating reque…

OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted provenance when session-derived text is persisted to session memory. In deployments where session-memory capture and dreaming are enabled, a restricted external sender whose messages are admitted with limited tools can persist instructions that are later supplied to…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

26/09/2026

[CVE-2026-100532] @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel…

@openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login and receive a new QR code for a configured account, disconnecting the Gateway's WhatsApp account and ca…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-91765] cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. A…

cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-100391] MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy rou…

MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Crítico vulnerabilidad

25/09/2026

[CVE-2026-97063] X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated end…

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes using known mobile numbers or email addresses, read them from responses, and authenticate as victims via POST /sys/emailOrMobileLogin/login to hijack accounts.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-49850] InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. …

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane exposes Invoices::delete() and Invoices::delete_invoice_tax() as state-changing routes without requiring POST and validating a CSRF token. When an authenticated administrator loads attacker-controlled content that requests an affected route, the application can delete an…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-93306] IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW10…

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web int…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-93834] A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main…

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-51773] An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker pr…

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-52622] An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES…

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98154] In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup ord…

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the hos…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98115] In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions du…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lock remains counted as a running request and only wakes when its file closes. Wake blocked locks duri…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-98017] In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing …

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTM_NEWQDISC request can make clsact bind a populated shared ingress block during ->init(), publishing an embedded mini_Qdisc to lockless readers. If the same request has an invalid TCA_RATE, estimator setup fails after ->init(); the unwind removes the pointer but synchron…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97991] In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-ran…

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim_blk: reject out-of-range sector starts vdpasim_blk_check_range() logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offset reach the data path. The invalid offset is used by three request paths. VIRTIO_BLK_T_OUT …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97589] In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return c…

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When crypto_finalize_hash_request() or crypto_finalize_skcipher_request() explicitly completes a request, the do_one_request callback must return 0 to indicate successful handling. Returning a negative error code causes the crypto engine to assume the driver failed…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

25/09/2026

Vulnerabilidad en plugin Modula Image Gallery para WordPress expone galerías privadas

El plugin Modula Image Gallery (versiones hasta 3.0.1) para WordPress contiene una falla de control de acceso que permite a atacantes acceder a galerías privadas sin autorización. La función Modula_Meta::add_metas() no valida el estado de publicación de las galerías, permitiendo divulgación no autorizada de contenido mediante parámetros GET. Afecta sitios WordPress en empresas y medios de LATAM que almacenan contenido sensible en galerías privadas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-62062] Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Reque…

Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elementor Website Builder: from n/a through 4.3.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/09/2026

[CVE-2026-97731] MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in…

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied X-Amz-SignedHeaders list. extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the claimed list and never enumerates the headers that actually arrived, and thus a header that arrives unsigned is neither hashed into the canonical request nor rejected. Because cmd/api…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-97326] A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d…

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/09/2026

[CVE-2026-93354] Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthe…

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and cl…

nvdaltovulnerabilidad CVSS 8.1 NVD