Alertas de Seguridad de la Información

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13783] Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin…

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13784] Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin…

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13786] Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute…

Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13787] Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote att…

Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13788] Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote att…

Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13791] Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allo…

Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13774] Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinc…

Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13777] Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 …

Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13778] Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to …

Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13779] Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote at…

Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71349] picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle…

picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using trace.Trace.run in the reduce method to achieve arbitrary code execution when pickle.load processes the file.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71350] picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run fu…

picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by victims.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71352] picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used i…

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71363] picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allow…

picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with cProfile.run payloads that bypass picklescan detection and achieve code execution upon deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71368] picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle fil…

picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debug_script calls that bypass picklescan detection and execute arbitrary commands upon pickle.load invocation.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71371] picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.ru…

picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payloads that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71374] picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used …

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-57585] MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out…

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

I Alto vulnerabilidad

30/06/2026

[CVE-2025-36359] IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expirati…

IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate another user on the system.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-13207] FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path no…

FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These re…

nvdaltovulnerabilidad CVSS 7.5 NVD