Alertas de Seguridad de la Información

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-0163] In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. Th…

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-56848] A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly whil…

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-11368] The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer w…

The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning channel via the static tx_meta_data_storage[] array (data->att_chan = chan). When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system workqueue (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_sent),…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-66315] Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ov…

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-62870] Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a netw…

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP anterior a 3.29.0 permite ejecución de código en clientes

FreeRDP antes de la versión 3.29.0 contiene un defecto de use-after-free en memoria del lado cliente que afecta el procesamiento de mensajes asincronos WINDOW_ICON_ORDER cuando la actualización asincrónica está habilitada. Un atacante puede explotar esta vulnerabilidad para ejecutar código arbitrario en sistemas que utilizan xfreerdp con flags /async-update. La falla impacta infraestructuras de escritorio remoto en empresas LATAM que dependen de FreeRDP para acceso remoto seguro.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP: uso de memoria liberada en cliente RDP

FreeRDP anterior a versión 3.29.0 contiene vulnerabilidades de uso de memoria liberada (heap use-after-free) en el lado del cliente cuando AsyncUpdate está habilitado. Un servidor RDP malicioso o comprometido puede enviar órdenes de actualización manipuladas que explotan copias superficiales de estructuras con punteros anidados, afectando órdenes RAIL WINDOW_STATE_ORDER y NOTIFY_ICON_STATE_ORDER. Empresas en LATAM que usan FreeRDP como cliente RDP o en soluciones de acceso remoto están expuestas a ejecución de código arbitrario.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-10685] The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth…

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may …

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-63035] A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an …

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-18017] Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute …

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

30/07/2026

[CVE-2026-18012] Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17967] Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17947] Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to po…

Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17920] Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use…

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

30/07/2026

[CVE-2026-17924] Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comp…

Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17918] Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute …

Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17894] Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker t…

Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17896] Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exec…

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17898] Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced…

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-17881] Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execu…

Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD