https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T16:42:43.512223+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110768 CVE-2026-110768 — holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist 2026-10-16T16:42:43.513043+00:00

Affected: holaboss-ai holaOS

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.