Alertas de Seguridad de la Información

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21032] Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant pr…

Improper export of android application components in SmartHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

nvdaltovulnerabilidad CVSS 7.1 NVD

S Alto vulnerabilidad

05/06/2026

[CVE-2026-21033] Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant …

Improper export of android application components in ExpressHomeWidgetReceiver of Samsung Assistant prior to version 9.3.14 allows local attacker to execute arbitrary script.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-11332] A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency speci…

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galax…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-49777] Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider…

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-6274] Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerabi…

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.

nvdcriticovulnerabilidad CVSS 9.8 NVD

H Alto vulnerabilidad

05/06/2026

[CVE-2026-21837] HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Man…

HCL Digital Experience is affected by an OS command injection vulnerability in the Digital Asset Management API.  An attacker may execute arbitrary operating system commands, typically inheriting the privileges of the vulnerable application, which could possibly lead to a complete system takeover and data compromise.

nvdaltovulnerabilidad CVSS 8.8 NVD

? Crítico alerta

05/06/2026

CISA registra nueva vulnerabilidad explotada activamente (CVE-2026-28318)

La Agencia de Ciberseguridad e Infraestructura Crítica de EE.UU. (CISA) ha añadido a su catálogo de vulnerabilidades conocidas y explotadas activamente la CVE-2026-28318, indicando que esta brecha ya está siendo aprovechada por atacantes en entornos reales. Aunque no se especifica el producto afectado en el advisory, su inclusión en el catálogo implica riesgo inmediato para infraestructura crítica en México y Latinoamérica. Las organizaciones deben priorizar esta vulnerabilidad en sus ciclos de parchado.

cisaus-certalerta CISA KEV

M Alto vulnerabilidad

05/06/2026

[CVE-2026-50593] Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actio…

Graphite before 1.3.15 has an integer underflow and resultant out-of-bounds write via Graphite actions, because slotat does not ensure that an offset is within the allowed slot-map range.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-7762] A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micr…

A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information El…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

05/06/2026

[CVE-2026-7763] A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro …

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. T…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

05/06/2026

[CVE-2026-41567] Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to…

Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operation…

nvdaltovulnerabilidad CVSS 7.2 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11303] Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11304] Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potent…

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11305] Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11306] Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11307] Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

Vulnerabilidad alta en Android OS (CVE-2026-11297) - CVSS 7.7

Google publica alerta sobre vulnerabilidad de severidad alta en Android OS que afecta más del 80% de dispositivos móviles en México y Latinoamérica. La falla permite comprometer la seguridad de terminales corporativas y personales. Se recomienda aplicar el parche de seguridad de inmediato en todos los dispositivos del inventario.

google-androidseguridad-movilandroid-os CVSS 7.7 NVD

G Alto vulnerabilidad

05/06/2026

Escalación de privilegios alta en Android OS (CVE-2026-11295) - CVSS 8.8

Vulnerabilidad de escalación de privilegios en Android OS con puntuación CVSS 8.8 afecta dispositivos móviles en México y Latinoamérica, representando riesgo significativo para más del 80% del parque móvil regional. Un atacante podría obtener permisos elevados sin autenticación explícita del usuario. La actualización de seguridad está disponible mediante el canal oficial de Google.

google-androidseguridad-movilandroid-os CVSS 8.8 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11296] Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remot…

Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 7.5 NVD

G Alto vulnerabilidad

05/06/2026

[CVE-2026-11301] Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote…

Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via malicious network traffic. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD