Alertas de Seguridad de la Información

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-19149] Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker t…

Use after free in Aura in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19150] Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacke…

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19151] Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute a…

Use after free in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19154] Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker…

Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19155] Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who ha…

Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19140] Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had com…

Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19145] Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to ex…

Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19111] Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools …

Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a forged namespace parameter. To remediate this issue, users should upgrade to version 0.8.3.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19137] Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacke…

Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19138] Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote att…

Heap buffer overflow in CrashReporting in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19139] Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attac…

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19062] A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. …

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Ther…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-18367] A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos…

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2026.1.1 and Sophos Home for macOS older than version 10.11.6.

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-16619] The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-facto…

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-16620] The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-si…

The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" price mode, allowing an unauthenticated visitor to add such a product to the cart at an arbitrary value below the merchant-defined allowed prices and commit a real order at that price (revenue loss / underpriced orders). This is a distinct, unfi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-17032] Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised…

Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-14812] The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a h…

The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

06/08/2026

[CVE-2026-11976] The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) wa…

The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retai…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-12584] The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the …

The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-13399] The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper autho…

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

nvdaltovulnerabilidad CVSS 7.5 NVD