Vulnerabilidades

Vulnerabilidades críticas que el gate ya conoce.

Cada seis horas Attestkeep descarga la Trivy vulnerability database, la misma que el scanner lee dentro de su cluster. Estas son las entradas que la database calificó como críticas esta semana, y cuándo. No cuándo salió la noticia: cuándo lo supo el gate.

IDVulnerabilidadCalificada desdePublicada
CVE-2026-95301
alta
chromium-browser: Missing authorization in Extensionsbuild de las 07:11 UTC
CVE-2026-95299
alta
chromium-browser: Use after free in GPUbuild de las 07:11 UTC
CVE-2026-95298
alta
chromium-browser: Use after free in Browserbuild de las 07:11 UTC
CVE-2026-95293
alta
chromium-browser: Uninitialized resource in GPUbuild de las 07:11 UTC
CVE-2026-95291
alta
chromium-browser: UI misrepresentation in SecurityIndicatorsbuild de las 07:11 UTC
CVE-2026-95286
alta
chromium-browser: Type confusion in Bindingsbuild de las 07:11 UTC
CVE-2026-95284
alta
chromium-browser: angle: Buffer overflow in ANGLEbuild de las 07:11 UTC
CVE-2026-95283
alta
chromium-browser: Buffer overflow in Tintbuild de las 07:11 UTC
CVE-2026-95282
alta
chromium-browser: Use after free in Platformbuild de las 07:11 UTC
CVE-2026-95281
alta
chromium-browser: angle: Buffer overflow in ANGLEbuild de las 07:11 UTC
CVE-2026-95280
alta
chromium-browser: Race condition in V8build de las 07:11 UTC
CVE-2026-95277
alta
chromium-browser: Use after free in Viewsbuild de las 07:11 UTC
CVE-2026-95274
alta
chromium-browser: Improper output encoding in DevToolsbuild de las 07:11 UTC
CVE-2026-102677
alta
electron: Electron: Privilege escalation via sandboxed preload code cache poisoningbuild de las 07:11 UTC
CVE-2026-102559
alta
libsoup: libsoup: Heap buffer overflow during WebSocket client-frame maskingbuild de las 07:11 UTC
CVE-2026-102558
alta
libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growthbuild de las 07:11 UTC
CVE-2026-102555
alta
libsoup: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decodingbuild de las 07:11 UTC
CVE-2026-92227
alta
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3build de las 07:11 UTC
CVE-2026-92222
alta
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3build de las 07:11 UTC
CVE-2026-90906
alta
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3build de las 07:11 UTC
CVE-2026-102675
alta
electron: Electron: Cross-origin information disclosure via improper CORS enforcement in custom protocol handlersbuild de las 07:11 UTC
CVE-2026-102557
alta
libsoup: libsoup: Heap buffer overflow during WebSocket message reassemblybuild de las 07:11 UTC
CVE-2026-102556
alta
libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusionbuild de las 07:11 UTC
CVE-2026-97689
alta
urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parserbuild de las 07:11 UTC
CVE-2026-97687
alta
urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration overridebuild de las 07:11 UTC
CVE-2026-84782
alta
openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmissionbuild de las 07:11 UTC
CVE-2026-102600
alta
Socket.IO: Prototype Pollution via Unsafe Client Session Lookupbuild de las 07:11 UTC
CVE-2026-100308
alta
gluonts: gluonts: Arbitrary command execution via untrusted model deserializationbuild de las 07:11 UTC
CVE-2026-68911
alta
nicotine-plus: nicotine-plus: Denial of Service via decompression bomb in peer messagesbuild de las 07:11 UTC
CVE-2026-63209
alta
github.com/klauspost/compress: klauspost/compress: Denial of Service via integer overflow in dictionary processingbuild de las 07:11 UTC
CVE-2026-100832
alta
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de las 07:11 UTC
CVE-2026-100811
alta
firefox: firefox: Sandbox escape via use-after-free in DOM componentbuild de las 07:11 UTC
CVE-2026-100793
alta
firefox: JIT miscompilation in the JavaScript Engine componentbuild de las 07:11 UTC
CVE-2026-100792
alta
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly componentbuild de las 07:11 UTC
CVE-2026-100791
alta
firefox: Use-after-free in the DOM: Core & HTML componentbuild de las 07:11 UTC
CVE-2026-100790
alta
firefox: thunderbird: Use-after-free in the XSLT componentbuild de las 07:11 UTC
CVE-2026-100789
alta
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de las 07:11 UTC
CVE-2026-100788
alta
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly componentbuild de las 07:11 UTC
CVE-2026-100787
alta
firefox: Sandbox escape in the XUL componentbuild de las 07:11 UTC
CVE-2026-100786
alta
firefox: Sandbox escape due to use-after-free in the Graphics componentbuild de las 07:11 UTC
CVE-2026-100785
alta
firefox: thunderbird: Use-after-free in the DOM: Core & HTML componentbuild de las 07:11 UTC
CVE-2026-100784
alta
firefox: Use-after-free in the Layout: Text and Fonts componentbuild de las 07:11 UTC
CVE-2026-100783
alta
firefox: thunderbird: Uninitialized memory in the Audio/Video componentbuild de las 07:11 UTC
CVE-2026-100782
alta
firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics componentbuild de las 07:11 UTC
CVE-2026-100781
alta
firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender componentbuild de las 07:11 UTC
CVE-2026-100780
alta
firefox: thunderbird: Use-after-free in the DOM: Core & HTML componentbuild de las 07:11 UTC
CVE-2026-100779
alta
firefox: thunderbird: Use-after-free in the XSLT componentbuild de las 07:11 UTC
CVE-2026-100778
alta
firefox: Sandbox escape due to use-after-free in the DOM: Core & HTML componentbuild de las 07:11 UTC
CVE-2026-100777
alta
firefox: thunderbird: Use-after-free in the Graphics: Canvas2D componentbuild de las 07:11 UTC
CVE-2026-100776
alta
firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly componentbuild de las 07:11 UTC

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.