Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70640] llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LL…

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijac…

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-43631] llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab…

llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerability by sending requests to affected endpoints while the server transitions to sleep mode, causing concurrent worker thre…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19139] Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attac…

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.4 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17993] Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perfo…

Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.0 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-17979] Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary co…

Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17855] Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had co…

Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17709] Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had c…

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17711] Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had c…

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17712] Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arb…

Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17654] Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform O…

Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62432] The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without …

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62430] Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs t…

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-64720] A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPa…

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-43805] A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPa…

A race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43755] A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 1…

A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43728] This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6.…

This issue was addressed through improved state management. This issue is fixed in macOS Tahoe 26.6. An attacker may be able to modify the state of the Keychain.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-43693] A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15…

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

A Crítico vulnerabilidad

27/07/2026

[CVE-2026-28982] A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, m…

A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote user may be able to cause unexpected system termination or corrupt kernel memory.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-28926] A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15…

A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to elevate privileges.

nvdaltovulnerabilidad CVSS 7.0 NVD

S Alto vulnerabilidad

20/07/2026

[CVE-2026-63756] SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc …

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.

nvdaltovulnerabilidad CVSS 8.1 NVD