Alertas de Seguridad de la Información

O Alto vulnerabilidad

16/06/2026

[CVE-2026-53853] OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that …

OpenClaw before 2026.5.12 contains an argument pattern validation bypass in the exec allowlist that allows attackers to execute disallowed arguments for allowlisted executables on Linux and macOS systems. Attackers can bypass configured argPattern restrictions by directly invoking allowlisted executables with unrestricted arguments, potentially enabling unauthorized file access, network access, or…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12315] Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firef…

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12316] Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Th…

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12294] Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox E…

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12295] Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefo…

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

16/06/2026

[CVE-2026-12296] Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefo…

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-12214] A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the …

A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the component Nucleus Engine Monitoring Logic. Performing a manipulation of the argument NetworkAddr results in protection mechanism failure. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47135] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combined with the bridge's set/defineProperty/deleteProperty traps having no isDangerousCrossRealmSymbol key check, sandbox code can obtain real cross-realm symbols, write them to host objects, and control host-side behavior — …

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47139] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding pub…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when th…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

12/06/2026

[CVE-2026-47140] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangero…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector. However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives. This allows sandboxed code to bypass the intended builtin restrictions and …

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

12/06/2026

[CVE-2026-47209] vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in b…

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes to the host target object. Per the Proxy set trap specification, when receiver !== proxy (e.g., when a child object inherits from the proxy via Object.create), the property assignment should create an own property on the …

nvdaltovulnerabilidad CVSS 8.6 NVD

G Crítico vulnerabilidad

11/06/2026

[CVE-2026-12027] Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote a…

Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12031] Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a …

Inappropriate implementation in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

A Alto vulnerabilidad

11/06/2026

[CVE-2025-24284] This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed i…

This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

11/06/2026

[CVE-2026-48546] KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute ar…

KanaDojo before 0.1.18 contains a sandbox escape vulnerability that allows an attacker to execute arbitrary code by exploiting the explicit passing of the global require function into a Node.js vm.runInNewContext() sandbox context in the issue-auto-respond.yml workflow. Attackers can submit a pull request modifying messages.cjs to import arbitrary Node.js modules, bypassing sandbox restrictions an…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50545] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, the Environment.spec.runtime.podSpec / spec.builder.podSpec passthrough lacked validation, and MergePodSpec propagated dangerous fields into the generated pods. This issue has been patched in version 1.24.0.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

10/06/2026

[CVE-2026-50564] Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of …

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's Environment CRD exposes spec.runtime.podSpec and spec.builder.podSpec, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated hostNetwork, hostPID, hostIPC, container privile…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48575] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48568] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-48570] Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a securi…

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

nvdaltovulnerabilidad CVSS 7.9 NVD