Alertas de Seguridad de la Información

F Alto vulnerabilidad

08/07/2026

[CVE-2026-56297] FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_cal…

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial …

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-5120] A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 coul…

A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

nvdaltovulnerabilidad CVSS 8.1 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13882] Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th…

Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

L Crítico vulnerabilidad

24/06/2026

[CVE-2026-53086] In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeo…

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when a single queue times out. This is over zealous and causes many race conditions with queues that are still chugging along. Instead lets only restart the timed out queue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53050] In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_a…

In the Linux kernel, the following vulnerability has been resolved: quota: Fix race of dquot_scan_active() with quota deactivation dquot_scan_active() can race with quota deactivation in quota_release_workfn() like: CPU0 (quota_release_workfn) CPU1 (dquot_scan_active) ============================== ============================== spin_lock(&dq_list_lock); list_replace_init( …

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-53020] In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race conditio…

In the Linux kernel, the following vulnerability has been resolved: um: Fix potential race condition in TLB sync During the TLB sync, we need to traverse and modify the page table, so we should hold the page table lock. Since full SMP support for threads within the same process is still missing, let's disable the split page table lock for simplicity.

nvdaltovulnerabilidad CVSS 7.8 NVD

L Alto vulnerabilidad

24/06/2026

[CVE-2026-52991] In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between fil…

In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execution on two separate CPUs: CPU0 CPU1 …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

22/06/2026

[CVE-2026-48505] Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un…

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

18/06/2026

[CVE-2026-42487] HVM guest I/O port accesses are subject to either emulation or at least translation. Translations a…

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.

nvdaltovulnerabilidad CVSS 7.9 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-12468] Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had co…

Race in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-12454] Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who …

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-0068] In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC…

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.

nvdaltovulnerabilidad CVSS 7.8 NVD

G Alto vulnerabilidad

17/06/2026

[CVE-2026-0083] In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This c…

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

15/06/2026

[CVE-2026-48708] OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and pr…

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance with no synchronization. When two or m…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

13/06/2026

[CVE-2026-54229] A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir …

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event handlers hold a write lock. This allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts ar…

nvdaltovulnerabilidad CVSS 7.0 NVD

G Alto vulnerabilidad

11/06/2026

[CVE-2026-12022] Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who …

Race in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-44693] Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior…

Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session management subsystem, introduced with the v6.0 rewrite of the embedded CivetWeb-based web server. This issue has been patched in version 6.6.1.

nvdaltovulnerabilidad CVSS 8.8 NVD

A Alto vulnerabilidad

10/06/2026

[CVE-2022-26758] A malicious application may cause unexpected changes in memory shared between processes. A memory co…

A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4.

nvdaltovulnerabilidad CVSS 7.1 NVD

G Alto vulnerabilidad

10/06/2026

[CVE-2026-1220] Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit …

Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-45598] Concurrent execution using shared resource with improper synchronization ('race condition') in Windo…

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.0 NVD