Alertas de Seguridad de la Información

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53829] OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticat…

OpenClaw before 2026.5.18 contains an approval display truncation vulnerability allowing authenticated users to hide command suffixes from approvers. Attackers can submit oversized exec commands with benign prefixes and malicious suffixes to execute unauthorized operations after approval.

nvdaltovulnerabilidad CVSS 8.0 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53831] OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowli…

OpenClaw before 2026.5.18 contains a policy enforcement vulnerability in system.run safe-bin allowlist validation that allows shell expansion to modify command interpretation on POSIX nodes. Authenticated operators can exploit shell metacharacters in approved commands to read unintended node-local files and expose sensitive configuration data.

nvdaltovulnerabilidad CVSS 8.3 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53832] OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-h…

OpenClaw before 2026.5.18 contains an identity header validation vulnerability allowing local same-host callers to forge trusted-proxy identity headers. Attackers with access to the proxy-facing Gateway port can supply forged identity headers to assume operator identity and potentially escalate privileges.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53833] OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming comm…

OpenClaw before 2026.4.29 contains an authorization bypass vulnerability in the QQBot streaming command that allows authenticated senders to mutate configuration without explicit allowFrom restrictions. Attackers can modify QQBot streaming configuration outside intended admin policy by reaching the affected command without non-wildcard allowlist entry requirements.

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53821] OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server…

OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.

nvdaltovulnerabilidad CVSS 8.8 NVD

O Alto vulnerabilidad

12/06/2026

[CVE-2026-53822] OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could …

OpenClaw before 2026.5.18 contains a command injection vulnerability where shell wrapper argv could change between approval and execution. Attackers can rebuild command arguments after allowlist approval to execute unapproved command shapes, potentially bypassing security controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-53519] Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prio…

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to version 2.0.13, fallbackToFrontend in the dashboard's NoRoute handler treats any URL whose raw string starts with /dashboard as an admin-frontend asset request. The check uses strings.HasPrefix, not a path-segment match, so the input /dashboard../data/config.yaml is accepted; strings.TrimPrefix…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-34195] Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API ca…

Software installed and run as a non-privileged user may conduct intentional GPU sparse memory API calls to cause out of bounds write in the kernel. The product incorrectly indexes internal state when performing sparse allocation remapping.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7011] Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containi…

Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds from 25020100 before 25021208. The affecte…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7017] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Win…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7002] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.68.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7003] Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF…

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Service of the antivirus engine process. This issue affects Avira Antivirus on Windows, macOS, and Linux for engine builds before 8.3.70.56.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7004] Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows P…

Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25040308. The affected scanning…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7008] Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE…

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310. The…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2025-7009] Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE…

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for virus definition builds before VPS 25021310. The affected scanning …

nvdaltovulnerabilidad CVSS 7.8 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54056] Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow …

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a stag…

nvdaltovulnerabilidad CVSS 7.6 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54057] Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-con…

Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.3, kitty's OSC 21 (color-control) query reply reflects attacker-controlled bytes, including newlines, into the shell's input without sanitization. Version 0.47.3 fixes the issue.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-44990] ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simp…

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a disallowed `xmp` element into live HTML or JavaScript. This is a sanitizer bypass in the default `disallowedTagsMode: 'discard'` path and can…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-45012] ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29…

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 contain an authenticated server-side request forgery (SSRF) in the rich-text widget import flow. An authenticated user who can submit/edit rich-text widget content can cause the server to fetch attacker-controlled URLs during widget validation. For image-compatible responses, the fetched content …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-45013] ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29…

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 have a password reset flow that constructs the reset URL using `req.hostname`, which is derived directly from the attacker-controlled HTTP `Host` header when `apos.baseUrl` is not explicitly configured. An unauthenticated attacker who knows a victim's email address can send a crafted reset reques…

nvdaltovulnerabilidad CVSS 8.1 NVD