Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 21 horas

[CVE-2026-84230] IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due t…

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad Nuevo

Hace 23 horas

[CVE-2026-84271] IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch inst…

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker with local access could exploit this vulnerability to execute arbitrary code with root privileges.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

Hace 2 días

[CVE-2026-106500] Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.…

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend.…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-56906] In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could le…

In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106426] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potenti…

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106377] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had co…

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106255] Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentiall…

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106238] Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had co…

Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-106201] Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute ar…

Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-105773] Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in…

Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a race condition and insufficient file validation, allowing a local attacker to execute arbitrary code with system privileges. Fixed in 3.11.1.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-58880] In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a…

In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-104970] Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint …

Plane is an open-source project management tool. From 0.13 until 1.4.0, InstanceAdminSignUpEndpoint in apps/api/plane/license/api/views/admin.py:89-117, 173-229 uses InstanceAdmin.objects.first() for the first-admin check and performs account creation without an atomic transaction, row lock, uniqueness guard, or advisory lock. Two concurrent unauthenticated requests with different email addresses …

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

01/10/2026

[CVE-2026-104057] Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurr…

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps (activePlayers and allConnections) in its WebSocket handler, where Wshandler and HandleWebsocketMessages goroutines read and write these maps without a mutex. A remote attacker can open multiple WebSocket connections to the /ws endpoint and send messages in a loop to trigge…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/09/2026

Vulnerabilidad de sincronización en funcionalidad de monitoreo permite denegación de servicio (CVE-2026-79625)

Múltiples productos presentan fallo en la sincronización de acceso a funcionalidad de monitoreo. Solicitudes concurrentes de clientes pueden causar lecturas/escrituras incorrectas o corrupción de estructuras de memoria internas. Un atacante autenticado con acceso de monitoreo puede explotar esto para procesamiento de datos incorrecto o denegación de servicio (CVSS 8.1).

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-95280] Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute ar…

Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

29/09/2026

[CVE-2026-100805] Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox…

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/09/2026

[CVE-2026-77762] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerab…

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121. The following versions were EOL at the time the CVE was created but are…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

22/09/2026

[CVE-2026-77633] Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg…

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transaction. An authenticated user with Files.Write permission can issue concurrent upload-session requests that …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

21/09/2026

[CVE-2026-61628] nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/use…

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act (TOCTOU) pattern between the "onboarding already completed?" check and the user-creation write, with no atomic guard, a remote unauth…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-58728] In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could le…

In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvdaltovulnerabilidad CVSS 7.0 NVD