Alertas de Seguridad de la Información

F Alto vulnerabilidad

09/06/2026

[CVE-2026-49475] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, a STUN packet whose declared attribute length is shorter than the structure the parser casts to causes the parser to read and write past the end of the attribute, producing an out-of-bounds me…

nvdaltovulnerabilidad CVSS 7.5 NVD

F Crítico vulnerabilidad

09/06/2026

[CVE-2026-49840] FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary …

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.1, esl_recv_event() parses Content-Length with atol() and passes the result straight to malloc(len + 1) with no sign or magnitude check. A malicious or man-in-the-middle ESL peer can send a frame…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48569] Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security…

Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45636] Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-44811] Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate priv…

Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-40376] Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privilege…

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

N Alto vulnerabilidad

09/06/2026

[CVE-2026-0419] Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit releas…

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows users connected to the local WiFi Networks to execute operating system commands. NETGEAR JR6150 has reached End-of-Support phase as of 2018 , and no further security updates are planned. NETGEAR strongly recommends replacing these devices with newer NETGEAR models to ensure cont…

nvdaltovulnerabilidad CVSS 8.0 NVD

G Crítico vulnerabilidad

09/06/2026

[CVE-2026-11697] Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a …

Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11689] Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remo…

Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11682] Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a re…

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11676] Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 1…

Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

09/06/2026

[CVE-2026-11660] Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 …

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Crítico vulnerabilidad

09/06/2026

[CVE-2026-11659] Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker t…

Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

N Alto vulnerabilidad

08/06/2026

[CVE-2026-49234] When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/or…

When sending a specifically crafted non-UTF-8 string as select-asn query parameter to the /api/v1/origins endpoint, Routinator crashes. This only affects users who allow API access from untrusted networks.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

08/06/2026

[CVE-2026-47430] ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WK…

## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated cal…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/06/2026

[CVE-2026-11460] A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function…

A flaw has been found in Boost Serialization up to 1.91. The impacted element is an unknown function. This manipulation causes improper validation of specified type of input. It is possible to initiate the attack remotely. The exploit has been published and may be used. The maintainer was notified on Aug 2025 and a disclosure deadline was set for 90 days. The maintainer acknowledged but postponed …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-45291] Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in v…

Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260418.124334-32` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least ve…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-36501] An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to ca…

An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11272] Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.78…

Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11255] Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.782…

Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD