Alertas de Seguridad de la Información

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-56700] Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserial…

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, Install…

nvdcriticovulnerabilidad CVSS 9.8 NVD

F Crítico vulnerabilidad

30/06/2026

[CVE-2026-56278] Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('f…

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to imperso…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-55721] Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by t…

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password …

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

30/06/2026

[CVE-2026-50110] Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embed…

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning succ…

nvdcriticovulnerabilidad CVSS 9.2 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14152] Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attac…

Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14113] Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attack…

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14120] Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at…

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14121] Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attac…

Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14101] Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a …

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14104] Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47…

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14106] Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.4…

Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14109] Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote att…

Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14093] Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had com…

Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14095] Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote …

Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14097] Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowe…

Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14055] Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.…

Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14056] Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed …

Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14037] Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote atta…

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14038] Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 a…

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.3 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14043] Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who…

Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD