Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-50646] Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code local…

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

14/07/2026

[CVE-2026-47305] Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locall…

Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/07/2026

[CVE-2026-61437] PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vuln…

PraisonAI (pip package praisonaiagents) before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow._resolve_pydantic_class (src/praisonai-agents/praisonaiagents/workflows/workflows.py). When a workflow step uses a string output_pydantic reference, the framework locates and imports a sibling tools.py from the workflow file's directory via importlib exec_module without sandbo…

nvdaltovulnerabilidad CVSS 7.8 NVD

P Alto vulnerabilidad

09/07/2026

[CVE-2026-0278] Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) compone…

Multiple protection mechanism failures in the Prisma Access Agent Data Loss Prevention (DLP) component for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

nvdaltovulnerabilidad CVSS 7.8 NVD

T Alto vulnerabilidad

04/07/2026

[CVE-2026-14535] In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unc…

In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequen…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

04/07/2026

[CVE-2025-71373] picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allow…

picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers can craft malicious pickle payloads using operator.methodcaller that execute arbitrary code when loaded, compromising systems relying on picklescan for validation.

nvdaltovulnerabilidad CVSS 8.1 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14409] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-14151] Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker…

Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14120] Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at…

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14101] Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a …

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14097] Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowe…

Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14037] Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote atta…

Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-14017] Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote …

Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

30/06/2026

[CVE-2026-13951] Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote atta…

Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13909] Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote…

Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

30/06/2026

[CVE-2026-13859] Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attac…

Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Alto vulnerabilidad

30/06/2026

[CVE-2025-71352] picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used i…

picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files with trace.Trace.runctx payloads that bypass picklescan detection and execute code upon pickle.load() invocation.

nvdaltovulnerabilidad CVSS 8.1 NVD

R Alto vulnerabilidad

29/06/2026

[CVE-2026-13601] A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation pr…

A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML in…

nvdaltovulnerabilidad CVSS 7.1 NVD

P Alto vulnerabilidad

25/06/2026

[CVE-2026-55487] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stri…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-48721] Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.…

Warp is an agentic development environment. From 0.2025.10.08.08.12.stable_00 until 0.2026.05.06.15.42.stable_01, Warp contains a command execution permission-check bypass in the default unsandboxed CLI agent profile. The CLI profile is non-interactive and relies on a command denylist as a safety boundary for commands that should require confirmation. Because command strings were checked before ca…

nvdaltovulnerabilidad CVSS 8.6 NVD