Alertas de Seguridad de la Información

O Alto vulnerabilidad

17/06/2026

[CVE-2026-35272] Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: D…

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks …

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2024-38487] api-gateway container running with root privilege would allow an attacker to escape the container an…

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-12289] Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1…

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-8176] The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab…

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-39118] An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privilege…

An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-36213] An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges v…

An issue in Microvirt MEmu Android Emulator 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12217] A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown f…

A security vulnerability has been detected in DVDFab Virtual Drive 2.0.0.5. Impacted is an unknown function in the library dvdfabio.sys of the component Signed Kernel Driver. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12018] Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a l…

Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

P Alto vulnerabilidad

11/06/2026

[CVE-2026-45176] Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within…

Idira Endpoint Privilege Manager Agent versions prior to 26.5 exhibit improper access control within high-privileged agent components. A local, low-privileged attacker could exploit this by manipulating an internal communication mechanism or file operation. Under specific circumstances, this could potentially allow the attacker to bypass permission restrictions and execute unauthorized local actio…

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-31272] The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may …

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute malicious code with elevated privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-50570] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, Fission added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability c…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-11616] The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in v…

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11296] Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remot…

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11103] Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed…

Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

04/06/2026

[CVE-2026-49189] Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software c…

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

nvdaltovulnerabilidad CVSS 7.8 NVD