Alertas de Seguridad de la Información

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12018] Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l…

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45176] Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within…

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actio…

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-31272] The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may …

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50566] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, a tenant with environments.fission.io create/update RBAC can run privileged / allowPrivilegeEscalation / dangerous-capability containers in the Fission function or builder namespace, scheduled under the executor's high-privilege serv…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50570] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability c…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50545] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50563] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Container Executor path lets a tenant supply Function.spec.podspec directly; the executor merges it into the executor-built podspec and creates a Deployment whose pods run the user's container image. This issue has been pat…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50564] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privile…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2025-6254] The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, …

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11616] The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in v…

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11296] Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remot…

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11103] Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed…

Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49189] Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software c…

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

02/06/2026

[CVE-2026-8206] The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable t…

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is used in the password reset request. This makes it possible for unauthenticated attackers to send a password reset link for any user registered…

nvdcriticovulnerabilidad CVSS 9.8 NVD