https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T15:16:23.790392+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-110768 fkie_cve-2026-110768 2026-10-16T15:16:23.818920+00:00

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.

 https://db.gcve.eu/vuln/ghsa-7c2w-92qq-g97q GHSA-7c2w-92qq-g97q 2026-10-16T15:16:23.819013+00:00

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.