Alertas de Seguridad de la Información

M Alto vulnerabilidad

29/09/2026

[CVE-2026-94204] The central cloud storage backend for the entire dashcam platform is misconfigured with public-read …

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102925] virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the genera…

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish scrip…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102253] iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated…

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76726] An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow …

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to restricted networks.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76727] Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that …

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-76728] A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated re…

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-61519] Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user h…

Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invite additional attacker-controlled accounts with elevated privileges by exploiting a flawed authorization predicate in TeamPolicy::addTeamMember() that grants invitation rights based solely on the existence of a pending invitation email match. Attackers can sen…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102875] VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader tha…

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102878] mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API t…

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102327] Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a r…

Incorrect authorization in WebView in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102328] Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102321] Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102323] Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102324] Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker…

Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102326] Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102317] Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed …

Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102302] Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute a…

Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102299] Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-102301] Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had…

Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100292] In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through …

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler.

nvdaltovulnerabilidad CVSS 8.8 NVD