Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79109] Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attac…

Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-79111] Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker …

Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79008] Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a rem…

Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

25/08/2026

[CVE-2026-78963] Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker…

Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

25/08/2026

[CVE-2026-78900] Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker…

Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-71443] CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result …

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-19913] The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to …

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non‑HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the clie…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-76840] RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buff…

RustDesk's Windows clipboard redirection copies a peer-supplied length into a fixed-size caller buffer without an upper bound check. When an OLE paste consumer such as explorer.exe calls IStream::Read with a buffer of cb bytes, CliprdrStream_Read in libs/clipboard/src/windows/wf_cliprdr.c requests that many bytes of a remote file through cliprdr_send_request_filecontents and then executes CopyMemo…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-59568] Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code executio…

Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-75975] fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validat…

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For example, a bracketed literal with invalid trailing characters is normalized to the unspecified address, whic…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/08/2026

[CVE-2026-78147] A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function dese…

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), wh…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

23/08/2026

[CVE-2026-7808] justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dange…

justhtml before 1.16.0 contains multiple HTML sanitization bypass issues that can allow active/dangerous content (e.g., script or style) to survive sanitization, potentially leading to cross-site scripting. The issues primarily affect advanced usage rather than the default JustHTML(..., sanitize=True) path for ordinary parsed HTML: mutating or reusing sanitization policy objects (including exporte…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

23/08/2026

[CVE-2026-5388] justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_valu…

justhtml before 1.15.0 contains multiple security issues in URL sanitization helpers (clean_url_value/clean_url_in_js_string), HTML serialization, Markdown passthrough (html_passthrough=True), and several custom sanitization-policy edge cases. Depending on configuration, an attacker can bypass sanitization to inject active HTML and JavaScript — for example via encoded javascript: URLs, backslash-b…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

22/08/2026

[CVE-2026-2996] The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to I…

The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 1.6.21. This is due to a logic flaw in the 'validate_cart_data' function. This makes it possible for unauthenticated attackers to bypass required paid addons and complete purchases at the base product price only, effectively stealing pro…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

21/08/2026

[CVE-2026-63421] Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packag…

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return mo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-48755] Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation…

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command execution. Version 7.1.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

21/08/2026

[CVE-2026-48769] Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file w…

Incus is a system container and virtual machine manager. Prior to version 7.2.0, an arbitrary file write exists in the Incus client when a malicious image server returns a crafted `Incus-Image-Hash` header. This can lead to arbitrary command execution as root on the server. Version 7.2.0 patches the issue.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

20/08/2026

[CVE-2026-66785] A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect ne…

A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious cluster, enabling it to declare arbitrary network ranges. Consequently, all network traffic intended for…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

20/08/2026

[CVE-2026-53587] libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a…

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 performs a fixed-size strncmp in set_data in src/libgit2/transports/smart_pkt.c without first verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git serve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

19/08/2026

[CVE-2026-76387] In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security ro…

In Splunk Enterprise Security versions below 8.6.1, a user who holds a Splunk Enterprise Security role that contains the mc_investigation_read capability could inject Search Processing Language (SPL) through Analyst Queue search filters, allowing for access to all relevant data and system integrity available to the scheduled searches that run for that user. The vulnerability is possible because th…

nvdaltovulnerabilidad CVSS 8.1 NVD