Alertas de Seguridad de la Información

G Alto vulnerabilidad

Hace 3 días

[CVE-2026-106205] Vulnerabilidad Android en Android OS - CVSS 8.1

Vulnerabilidad de seguridad en Android (Android OS): Vulnerabilidad de seguridad en Android. CVSS: 8.1. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-os CVSS 8.1 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106190] Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute…

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106191] Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who…

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106193] Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execut…

Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106194] Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote att…

Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106197] Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execu…

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106186] Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0…

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.6 NVD

G Alto vulnerabilidad

Hace 3 días

[CVE-2026-106188] Vulnerabilidad Android en Android System - CVSS 7.1

Vulnerabilidad de seguridad en Android (Android System): Vulnerabilidad de seguridad en Android. CVSS: 7.1. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-system CVSS 7.1 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-102322] Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote at…

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105793] Vulnerabilidad Android en Android Framework - CVSS 9.1

Vulnerabilidad de seguridad en Android (Android Framework): Vulnerabilidad de seguridad en Android. CVSS: 9.1. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-framework CVSS 9.1 NVD

G Alto vulnerabilidad

Hace 3 días

[CVE-2026-105788] Vulnerabilidad Android en Android Framework - CVSS 8.8

Vulnerabilidad de seguridad en Android (Android Framework): Vulnerabilidad de seguridad en Android. CVSS: 8.8. Afecta dispositivos Android, 80%+ del mercado movil en Mexico y LATAM. Actualiza tu dispositivo en Ajustes - Actualizacion del sistema.

google-androidseguridad-movilandroid-framework CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-100511] Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-goog…

Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 4 días

Vulnerabilidad alta de SSRF en feelec-yishu feelcrm-os 1.0.0

Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en feelcrm-os versión 1.0.0 que permite manipular el parámetro URL en el endpoint getCurlData del controlador GoogleController.class.php. Un atacante remoto puede ejecutar solicitudes no autorizadas desde el servidor afectado hacia sistemas internos o externos, comprometiendo la confidencialidad de datos y la integridad de la infraestructura. El exploit ha sido divulgado públicamente, elevando significativamente el riesgo para empresas mexicanas y latinoamericanas que utilicen este CRM.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-105222] The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by…

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2014-125130] CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contai…

CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103622] Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute a…

Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-103625] Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

02/10/2026

[CVE-2026-103628] Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to ex…

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

02/10/2026

[CVE-2026-91828] The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not …

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

[CVE-2026-102395] Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps

nvdaltovulnerabilidad CVSS 7.1 NVD