Alertas de Seguridad de la Información

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13783] Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin…

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13784] Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convin…

Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13785] Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker…

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13786] Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute…

Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13787] Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote att…

Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13788] Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote att…

Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13789] Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp…

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13792] Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker …

Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13774] Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinc…

Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13775] Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp…

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13778] Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to …

Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13779] Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote at…

Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2026-57585] MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out…

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43731] A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari …

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-43715] A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari …

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.

nvdaltovulnerabilidad CVSS 8.8 NVD

Z Alto vulnerabilidad

28/06/2026

[CVE-2026-10646] Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a po…

Zephyr's BSD-sockets getaddrinfo() implementation (subsys/net/lib/sockets/getaddrinfo.c) passes a pointer to a stack-allocated state object (struct getaddrinfo_state ai_state) as the user_data of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set slightly longer than the resolver's own per-query timeout. When that semaphore wait nonetheless ti…

nvdaltovulnerabilidad CVSS 7.4 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49417] Second, the audio buffer backing a mapping could be freed when the device was closed even though the…

Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid. The freed memory could then be reused elsewhere while still accessible through the stale mapping. The /dev/dsp device nodes are world-accessible by default. On a system with an audio device, either issue allows an unprivileged local user to read and write kernel memory, w…

nvdaltovulnerabilidad CVSS 7.0 NVD

F Alto vulnerabilidad

27/06/2026

[CVE-2026-49412] The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter l…

The kernel handler for IPV6_MSFILTER dropped a serializing lock in order to copy the source-filter list from userspace, then reacquired the lock. During this window another thread could free the multicast filter structure, leaving the handler with a stale pointer to freed memory. An unprivileged local user can exploit this use-after-free to escalate privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53300] In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-af…

In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix NTMP DMA use-after-free issue The AI-generated review reported a potential DMA use-after-free issue [1]. If netc_xmit_ntmp_cmd() times out and returns an error, the pending command is not explicitly aborted, while ntmp_free_data_mem() unconditionally frees the DMA buffer. If the buffer has already been reallocate…

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

26/06/2026

[CVE-2026-53296] In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free cha…

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: free channels on probe error On probe error, free the previously obtained channels. This not only prevents a leak, but also UAF scenarios because the client structure will be removed nonetheless because it was allocated with devm.

nvdaltovulnerabilidad CVSS 7.8 NVD