Alertas de Seguridad de la Información

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11636] Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote atta…

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11641] Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote att…

Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11632] Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who co…

Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/06/2026

[CVE-2026-46484] Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Head…

Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This issue has been patched in versions 0.6.3 and 0.7.0-beta.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46299] In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on…

In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_init() to initialize a search structure, which acquires tree->tree_lock. If the subsequent call to hfsplus_cat_build_key() fails, the function jumps to the out_put_root error label without releasing the lock. The later cleanup path then free…

nvdaltovulnerabilidad CVSS 7.0 NVD

L Alto vulnerabilidad

08/06/2026

[CVE-2026-46280] In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pag…

In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_f…

nvdaltovulnerabilidad CVSS 7.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46477] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, dataset create and update mass-assignment allows cross-workspace dataset takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46478] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, DatasetRow create and update mass-assignment allows cross-workspace row takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46479] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluation create and update mass-assignment allows cross-workspace evaluation takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46480] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, evaluator create and update mass-assignment allows cross-workspace evaluator takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46444] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vector Store have no authentication middleware and the route path /api/v1/openai-assistants-vector-store is not in WHITELIST_URLS. However, it is also not protected by the main auth middleware when accessed via API key — the route requires API ke…

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46475] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, assistant create and update mass-assignment allows cross-workspace assistant takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-46476] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, CustomTemplate create and update mass-assignment allows cross-workspace template takeover. This issue has been patched in version 3.1.2.

nvdaltovulnerabilidad CVSS 8.8 NVD

F Alto vulnerabilidad

08/06/2026

[CVE-2026-42863] Flowise is a drag & drop user interface to build a customized large language model flow. Prior to ve…

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify server-controlled properties such as deployed, isPublic, workspaceId, createdDate, and updatedDate when updating a chatflow object. Due to missing server-side valid…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto amenaza

07/06/2026

URLhaus Daily Report — 799 URLs Maliciosas Detectadas (7 de junio de 2026)

URLhaus (abuse.ch) reportó 799 URLs maliciosas nuevas en las últimas 24 horas. 254 siguen activas. URLhaus rastrea URLs usadas para distribuir malware, botnets y payloads maliciosos a nivel global.

threat-intelurlhausabuse-ch Editorial

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11450] A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the lib…

A vulnerability was detected in GL.iNet GL-MT3000 4.4.5. This affects the function dlopen in the library /usr/lib/oui-httpd/rpc/ of the component Path Normalization Handler. Performing a manipulation of the argument dev_name results in command injection. It is possible to initiate the attack remotely. Upgrading to version 4.7 mitigates this issue. It is advisable to upgrade the affected component.…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/06/2026

[CVE-2026-9290] The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local …

The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass acc…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-46493] HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `u…

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generating salts, which is unsuitable. Version 26.0.1 fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45327] TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authent…

TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcry…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

nvdaltovulnerabilidad CVSS 8.3 NVD