Alertas de Seguridad de la Información

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10906] Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacke…

Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10899] Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker w…

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10900] Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker…

Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

04/06/2026

[CVE-2026-10901] Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker…

Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10872] A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserve…

A vulnerability was found in Shibby Tomato 1.28.0000. This issue affects the function start_vpnserver of the file /sbin/rc of the component Web UI. Performing a manipulation results in os command injection. The attack can be initiated remotely. The exploit has been made public and could be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10873] A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of t…

A vulnerability was determined in Shibby Tomato 1.28.0000. Impacted is the function rstats_path of the file /bin/rstats of the component Web UI. Executing a manipulation can lead to os command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10871] A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function s…

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of the file /sbin/rc of the component Web UI. Such manipulation of the argument ipv6_6rd_borderrelay leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-10870] A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file …

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the component Web UI. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This project is superseded by FreshTomato.

nvdaltovulnerabilidad CVSS 7.2 NVD

O Alto vulnerabilidad

04/06/2026

[CVE-2026-10796] nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied …

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2025-59874] HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is det…

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41010] ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@re…

ReleaseJob#unpack builds job_dir = File.join(@release_dir, 'jobs', name) and job_tgz = File.join(@release_dir, 'jobs', "#{name}.tgz") where name returns @job_meta['name'], a value taken verbatim from the jobs: array of the attacker-supplied release.MF inside the uploaded tarball. These paths are then interpolated into a shell string: Bosh::Common::Exec.sh("tar -C #{job_dir} -xf #{job_tgz} 2>&1", :…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41011] PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packa…

PackagePersister.validate_tgz builds "tar -tf #{tgz} 2>&1" where tgz = File.join(release_dir, 'packages', "#{name}.tgz") and name = package_meta['name'] comes directly from release.MF inside the uploaded tarball. The string is passed to Bosh::Common::Exec.sh, which executes via %x{} — i.e., /bin/sh -c. No Shellwords.escape is applied. The Models::Package Sequel validation (VALID_ID = /^[-0-9A-Za-z…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

04/06/2026

[CVE-2026-41859] A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentia…

A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secret) and can tamper with the VM list that is written into the NATS authorization file. Stolen credentials grant administrative director access. UsersSync#bosh_api_response_body builds a Net::HTTP client with verify_mode = OpenSSL::SSL::VERIFY_NONE for every dir…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44609] Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: …

Local privilege escalation due to EXE hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-44682] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-50033] Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: …

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

03/06/2026

[CVE-2026-42061] Local privilege escalation due to excessive permissions assigned to child processes. The following p…

Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis DeviceLock DLP (Windows) before build 9.0.15051.93227.

nvdaltovulnerabilidad CVSS 7.3 NVD

S Alto vulnerabilidad

02/06/2026

[CVE-2026-42211] React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a c…

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-1829] The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution …

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.02 via the 'et_pb_text' shortcode 'cvdb_content_visibility_check' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/06/2026

[CVE-2026-10617] A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the…

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAuth of the file internal/http/auth.go of the component Webhook Verification Handler. The manipulation leads to missing authentication. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The project tagged the reported issue as bu…

nvdaltovulnerabilidad CVSS 7.3 NVD