Alertas de Seguridad de la Información

M Crítico vulnerabilidad

19/08/2026

[CVE-2026-20318] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Wo…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20318 are related to improper input validation issues that ar…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

13/08/2026

[CVE-2026-49827] WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1…

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chai…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

11/08/2026

[CVE-2026-48056] Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions p…

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the  run-download  IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 contains a patch.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

10/08/2026

[CVE-2026-72867] Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomp…

Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch, branch, gitlabBranch, bitbucketBranch, or giteaBranch. A low-privileged authenticated user can trig…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

07/08/2026

Vulnerabilidad crítica en Kata Containers permite ejecución de código en el host

Kata Containers anterior a versión 4.0.0 es vulnerable a ejecución de código en el host mediante anotaciones de configuración sin validar. Un atacante puede especificar una ruta TOML arbitraria a través de la anotación io.katacontainers.config_path para cargar archivos maliciosos del host. Esta vulnerabilidad afecta infraestructuras containerizadas en datacenters y plataformas cloud de empresas LATAM que ejecuten orquestación con Kubernetes.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-57817] The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter …

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/08/2026

[CVE-2026-20303] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst …

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are g…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

01/08/2026

Vulnerabilidad crítica de bypass de autorización en @better-auth/scim (CVE-2026-67330)

El plugin @better-auth/scim para better-auth en versiones 1.4.0-beta.27 a 1.6.21 y 1.7.0-beta.0 a 1.7.0-beta.9 contiene una falla de autorización que permite a atacantes reutilizar identificadores de proveedores SSO/SAML/OIDC existentes en la emisión de tokens SCIM, comprometiendo la identidad de usuarios y cuentas corporativas. Afecta principalmente sistemas de gestión de identidades y acceso (IAM) en empresas que implementan provisionamiento automático de usuarios.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-18002] Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 al…

Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17987] Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 …

Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17990] Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allow…

Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17991] Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a r…

Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17940] Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior t…

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17847] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17848] Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to pote…

Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17837] Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allow…

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17834] Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allo…

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17803] Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 …

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17768] Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 all…

Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17713] Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151…

Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD