Alertas de Seguridad de la Información

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-45733] Trilium Notes is a cross-platform, hierarchical note taking application focused on building large pe…

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute …

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 6 días

[CVE-2026-74883] openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbo…

openssl_encrypt versions before 1.4.0 contain a sandbox bypass vulnerability where the plugin sandbox fails to restrict alternative file access methods like pathlib.Path and io.open. Attackers can import pathlib or io modules to read and write arbitrary files, completely bypassing the restricted_open file access controls.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-18428] A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allo…

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-69278] Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security f…

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-54981] Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension al…

Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-72781] Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code e…

Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe (via the AllowedInSandbox attribute) and the sandbox allowlisting extends to the entire class hierarchy (craft\base\Component up to yii\base\Component), an authenticated attacker with permission to…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19168] Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacke…

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19150] Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacke…

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70608] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.3, and 42.0.1, a sandboxed iframe without the allow-popups keyword could still open a new window or trigger setWindowOpenHandler with no user interaction because new-window navigations taking the OpenURL path did not apply the iframe sandbox popup restriction. Apps that e…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-70601] Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and C…

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17899] Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attac…

Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17677] Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a r…

Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-67427] Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workf…

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue…

nvdaltovulnerabilidad CVSS 8.6 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-28912] A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8,…

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A user may be able to elevate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-44090] An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and…

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-50324] An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary co…

An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-50327] An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privile…

An issue in Franco Corbelli ZPAQFRANZ v.61.3 and before allows a remote attacker to escalate privileges and execute arbitrary code via a bypass of the Mark-of-the-Web protection mechanism

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-50330] An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate pr…

An issue in ZipGenius Team ZipGenius v.6.3.2.3116 and before allows a remote attacker to escalate privileges and execute arbitrary code via the zipgenius.exe.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

22/07/2026

[CVE-2025-44089] An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloadin…

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

16/07/2026

[CVE-2026-44982] CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/re…

CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using Transfer-Encoding: chunked and HTTP/2 requests without a content-length header produced an empty body and caused WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON,…

nvdaltovulnerabilidad CVSS 7.2 NVD