Alertas de Seguridad de la Información

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15125] Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote atta…

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15126] Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Use after free in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15110] Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convin…

Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15111] Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convi…

Use after free in Views in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15112] Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potent…

Use after free in Ozone in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15114] Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote att…

Out of bounds read and write in Codecs in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15116] Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Use after free in Actor in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15117] Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who co…

Use after free in Payments in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15118] Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execut…

Use after free in Input in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-15107] Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to ex…

Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55878] Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.…

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative() accepts paths like ../../../etc, a crafted or compromised kit can write attacker-controlled content to arbitrary locations or read local files outside the …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-51535] In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in …

In OpENer 2.3.0 (commit 76b95cf), a resource exhaustion (Denial of Service) vulnerability exists in its network processing loop.

nvdaltovulnerabilidad CVSS 7.5 NVD

H Alto vulnerabilidad

08/07/2026

[CVE-2026-55470] HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in J…

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, the fix for CVE-2026-45367 incompletely patched the DSTU2 module, leaving FHIRPathEngine.matches() in org.hl7.fhir.dstu2/utils/FHIRPathEngine.java to call raw String.matches(sw) without RegexTimeout protection while replaceMatches() was updated, allowing an unauthenticated atta…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-55830] RestrictedPython is a tool that helps to define a subset of the Python language which allows to prov…

RestrictedPython is a tool that helps to define a subset of the Python language which allows to provide a program input into a trusted environment. Prior to 8.3, check_function_argument_names() rejected protected guard hook names for regular, variadic, and keyword-only arguments but omitted positional-only arguments, allowing __getattr__, _getitem_, _write_, or _print_ to be shadowed by a local pa…

nvdaltovulnerabilidad CVSS 8.3 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44025] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's Monitor Agent plugin in_monitor_agent exposes internal metrics and plugin information via a REST API, and responses from /api/plugins.json and related endpoints unintentionally include internal instance variables that may contain database passwords, API…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44160] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size a…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Alto vulnerabilidad

08/07/2026

[CVE-2026-44161] Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS…

Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-35552] In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an…

In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API endpoint intended for privileged users. Due to missing authorization checks, this allows the attacker to deactivate the application's license.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-10037] A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME hand…

A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, an…

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

08/07/2026

[CVE-2026-6896] GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 b…

GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute arbitrary scripts in another user's browser session due to improper sanitization of user-supplied input.

nvdaltovulnerabilidad CVSS 8.7 NVD