Alertas de Seguridad de la Información

L Alto vulnerabilidad

01/07/2026

[CVE-2026-53329] In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_a…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Use krealloc_array() in dal_vector_reserve() [Why & How] dal_vector_reserve() computes the allocation size as "capacity * vector->struct_size" using uint32_t arithmetic, which can silently wrap to a small value on overflow. This would cause krealloc to return a smaller buffer than expected, leading to heap overf…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-11794] The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not re…

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-11883] The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the s…

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-1239] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

nvdaltovulnerabilidad CVSS 7.5 NVD

U Alto vulnerabilidad

01/07/2026

[CVE-2026-7829] UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/de…

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an aut…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-13468] The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerab…

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — includ…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56300] Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_or…

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-56233] Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allow…

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in ser…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-54672] electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets …

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared li…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14114] Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 al…

Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14099] Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14064] Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attac…

Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14024] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w…

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14025] Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who…

Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14027] Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convi…

Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14005] Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attack…

Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13968] Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allow…

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13925] Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed…

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13927] Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 …

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13915] Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD