Alertas de Seguridad de la Información

G Crítico vulnerabilidad

08/07/2026

[CVE-2026-15113] Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote atta…

Use after free in Autofill in Google Chrome on Android prior to 150.0.7871.115 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15114] Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote att…

Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15116] Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15117] Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who co…

Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15118] Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15107] Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to ex…

Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55878] Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-51535] In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in …

In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-52200] An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrar…

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Alto vulnerabilidad

08/07/2026

[CVE-2026-55470] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated atta…

nvdaltovulnerabilidad CVSS 7.5 NVD

H Crítico vulnerabilidad

08/07/2026

[CVE-2026-55471] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger X…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55830] RestrictedPython is a tool that helps to define a subset of the Python language which allows to prov…

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local pa…

nvdaltovulnerabilidad CVSS 8.3 NVD

F Crítico vulnerabilidad

08/07/2026

[CVE-2026-44024] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd allows dynamically constructing file paths using the ${tag} placeholder, and insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin allows attackers sending untrusted tags containing path traversal chara…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44025] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44160] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size a…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44161] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

08/07/2026

[CVE-2026-31309] Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 bef…

Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrarily overwrite the node's configuration and achieve a full node takeover via a crafted POST request.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-35552] In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an…

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10037] A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME hand…

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, an…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-6896] GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD