Alertas de Seguridad de la Información

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11151] Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.…

Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11086] Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attack…

Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11079] Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed…

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory write via a crafted video file. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11046] Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed …

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-11041] Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.…

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10969] Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 all…

Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10970] Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53…

Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10968] Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.5…

Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.4 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10942] Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a loca…

Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10920] Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.5…

Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10922] Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allow…

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via malicious network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10911] Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed …

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10917] Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed …

Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10904] Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10863] A security issue was fixed in the correlations over-correlation endpoint where the order query param…

A security issue was fixed in the correlations over-correlation endpoint where the order query parameter was accepted from user-controlled named request parameters. This allowed an authenticated user to override the server-defined ordering of over-correlating values. Depending on how the value was processed by the underlying data access layer, this could allow manipulation of database query orderi…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-37460] Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.…

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-35081] The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processe…

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficient validation of user-supplied input.

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

02/06/2026

[CVE-2026-47201] authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, …

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. This issue has been patched in versions 2025.12.5, 2026…

nvdaltovulnerabilidad CVSS 8.5 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45685] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.1.0 to before version 0.9.0, malformed MongoDB wire messages can trigger uncaught panics in the MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service. The parser operates on raw attacker-controlled network payloads …

nvdaltovulnerabilidad CVSS 7.5 NVD

O Alto vulnerabilidad

02/06/2026

[CVE-2026-45678] OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard…

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Postgres protocol parser assumes BIND message payloads contain a valid NUL-terminated portal name. A crafted empty or unterminated payload can make OBI slice beyond the end of the captured buffer and panic. This issue has been patched in version 0.9.0.

nvdaltovulnerabilidad CVSS 7.5 NVD