Alertas de Seguridad de la Información

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14400] Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who h…

Out of bounds write in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14401] Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.…

Insufficient validation of untrusted input in ANGLE in Google Chrome on Android prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14403] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14405] Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute…

Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14387] Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potent…

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14389] Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had c…

Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14390] Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potenti…

Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14392] Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to pot…

Out of bounds write in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14393] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14394] Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentiall…

Use after free in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14395] Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execu…

Out of bounds write in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Crítico vulnerabilidad

01/07/2026

[CVE-2026-14382] Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed …

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

G Alto vulnerabilidad

01/07/2026

[CVE-2026-14383] Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker…

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-52186] SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to e…

SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to execute arbitrary code via the gohead/sub_463bbc component

nvdcriticovulnerabilidad CVSS 9.8 NVD

T Alto vulnerabilidad

01/07/2026

[CVE-2026-54263] Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3…

Wagtail is an open source content management system built on Django. In versions prior to 7.0.8, 7.3.3 and 7.4.2, reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perfor…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-58263] Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4…

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/ carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-50521] Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over…

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

01/07/2026

[CVE-2026-54074] Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote …

Tina is a headless content management system. @tinacms/cli versions prior to 2.4.3 contain a Remote Code Execution vulnerability in the Forestry-to-Tina migration command. The internal helper addVariablesToCode unquotes any value matching the marker "__TINA_INTERNAL__:::(.*?):::" inside the stringified collection JSON. User-supplied label and name fields from .forestry/**/*.yml are placed into tha…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

01/07/2026

[CVE-2026-58457] Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command inj…

Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS command injection vulnerability that allows network-adjacent attackers to execute arbitrary shell commands by injecting unsanitized input through the smacfilter_conf handler in the commuos web backend. Attackers can append semicolon-delimited payloads to the name, enable, or mac GET parameters, which are passe…

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-14265] Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced …

Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering w…

nvdaltovulnerabilidad CVSS 7.5 NVD