Alertas de Seguridad de la Información

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106358] Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to ex…

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106329] Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attac…

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106323] Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a …

Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106298] Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote att…

Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106281] Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentia…

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106241] Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a re…

Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106234] Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveragi…

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106239] Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote att…

Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106227] Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute …

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106211] Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leverag…

Use after free in TabStrip in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106197] Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execu…

Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-102322] Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote at…

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-106102] Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.…

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. A…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105857] Payload is a free and open source headless content management system. In @payloadcms/plugin-form-bui…

Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can craft a form submission that executes code remotely on the server. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105859] Payload is a free and open source headless content management system. In versions before 3.90.0 and …

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing collection or field-level access control when orderable is enabled on a collection or join field. This issue is fixed in versions 3.90.0 and 4.0…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-104070] The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows …

The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a m…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67273] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of S…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-105845] Payload is a free and open source headless content management system. In versions from 3.0.0 before …

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query readable collections through dynamic filters or joins can submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-63692] Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Cr…

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-67269] Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privile…

Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could potentially exploit this vulnerability, leading to escalation of privileges and gaining root-level access on cluster nodes.

nvdcriticovulnerabilidad CVSS 9.9 NVD