Alertas de Seguridad de la Información

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46476] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-42863] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side valid…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto amenaza

07/06/2026

URLhaus Daily Report — 799 URLs Maliciosas Detectadas (7 de junio de 2026)

URLhaus (abuse.ch) reportó 799 URLs maliciosas nuevas en las últimas 24 horas. 254 siguen activas. URLhaus rastrea URLs usadas para distribuir malware, botnets y payloads maliciosos a nivel global.

threat-intelurlhausabuse-ch Editorial

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11450] A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the lib…

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-9290] The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local …

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass acc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-46493] HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `u…

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45327] TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent…

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcry…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD

7 Alto vulnerabilidad

05/06/2026

[CVE-2026-48095] 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buff…

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

Vulnerabilidad alta en Android OS (CVE-2026-21029) con CVSS 7.8 afecta dispositivos en LATAM

Google Android ha publicado un advisory sobre una vulnerabilidad de severidad alta (CVSS 7.8) en Android OS que impacta millones de dispositivos móviles en México y Latinoamérica, representando más del 80% del parque móvil regional. Esta falla de seguridad requiere actualización inmediata en todos los equipos corporativos y personales para prevenir explotación remota.

google-androidseguridad-movilandroid-os CVSS 7.8 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21031] Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch a…

Improper authorization in AppBlock prior to SMR Jun-2026 Release 1 allows local attacker to launch arbitrary activity. User interaction is required for triggering this vulnerability.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11332] A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency speci…

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galax…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11272] Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.78…

Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-10586] The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress i…

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web applicati…

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11237] Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed …

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11177] Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who conv…

Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

Vulnerabilidad alta en Android OS (CVE-2026-11172) — CVSS 8.8

Se ha identificado una vulnerabilidad de seguridad alta en Android OS con puntuación CVSS 8.8 que afecta dispositivos móviles en México y Latinoamérica, representando más del 80% del mercado móvil regional. Esta falla compromete la integridad y disponibilidad de sistemas en dispositivos Android, impactando tanto usuarios individuales como infraestructuras corporativas que dependen de estos equipos.

google-androidseguridad-movilandroid-os CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

Vulnerabilidad alta en Android OS (CVE-2026-11085) - CVSS 8.8

Google ha publicado un parche de seguridad para una vulnerabilidad alta en Android OS con puntuación CVSS de 8.8. Esta falla afecta a más del 80% de dispositivos móviles en México y Latinoamérica, exponiendo equipos corporativos y personales a compromisos de seguridad. La actualización está disponible en todos los canales de distribución de Android.

google-androidseguridad-movilandroid-os CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11042] Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convin…

Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10995] Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker w…

Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD