Alertas de Seguridad de la Información

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14387] Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potent…

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14389] Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had c…

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14390] Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potenti…

Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14392] Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to pot…

Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14393] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14394] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentiall…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14395] Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execu…

Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14382] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14383] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-52186] SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to e…

SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Alto vulnerabilidad

01/07/2026

[CVE-2026-54263] Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3…

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perfor…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58263] Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4…

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-50521] Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over…

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-54074] Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote …

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into tha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58457] Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command inj…

Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-14265] Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced …

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering w…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-14363] Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i…

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Crítico vulnerabilidad

01/07/2026

[CVE-2026-53492] containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI…

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations from the checkpoint archive rather than relying sol…

nvdcriticovulnerabilidad CVSS 9.6 NVD

C Medio vulnerabilidad

01/07/2026

[CVE-2026-53489] containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a b…

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue has been fixed in versions 2.3.2, 2.2.5 and 2.1.9.

check-pointcheckpointmedio CVSS 6.5 NVD

H Crítico vulnerabilidad

01/07/2026

[CVE-2026-50160] Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from ve…

Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass assignment. The global NestJS ValidationPipe is configured without whitelist: true, so extra properties on the request body that are not declared in SaveOnboardingConfigRequest are not stripped …

nvdcriticovulnerabilidad CVSS 10.0 NVD