Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1012

Esta semana

RSS

Vulnerabilidades × Alta × cwe-191 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-19186] ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len…

ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len - authtag_len without first checking that the received frame is at least ll_hdr_len + authtag_len bytes long. All three variables are uint8_t, so a frame whose payload is shorter than the configured authentication tag makes the subtraction wrap around to a large …

M Alto vulnerabilidad

[CVE-2026-47585] NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacke…

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

M Alto vulnerabilidad

[CVE-2026-47540] NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer wh…

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

M Alto vulnerabilidad

[CVE-2026-88376] Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAto…

Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination, le…

M Alto vulnerabilidad

[CVE-2026-93599] rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reacha…

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly [0x00] (zero padding bits and no data bytes), so raw_bits.len() - 1 underflows on the empty slice and the subsequent index operation panics (subtract-with-overflow in debug,…

M Alto vulnerabilidad

[CVE-2026-89028] MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB d…

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a uniPwdLen field that triggers an integer underflow, causing the resulting value to be used as the copy …

M Alto vulnerabilidad

[CVE-2026-91948] FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static vi…

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-66307] Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny…

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

M Alto vulnerabilidad

[CVE-2026-71352] Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authori…

Integer underflow (wrap or wraparound) in Windows Remote Access Connection Manager allows an authorized attacker to execute code over a network.

M Alto vulnerabilidad

[CVE-2026-69859] Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) a…

Time-of-check time-of-use (toctou) race condition in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

[CVE-2026-69687] Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an au…

Integer underflow (wrap or wraparound) in Windows USB Audio Class driver (usbaudio.sys) allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

[CVE-2026-69421] Integer underflow (wrap or wraparound) in Windows Kernel Mode Driver allows an authorized attacker t…

Integer underflow (wrap or wraparound) in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

[CVE-2026-69269] Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to el…

Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

[CVE-2026-68827] Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate priv…

Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network.

M Alto vulnerabilidad

[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-18355] A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). I…

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). In sasl_io_start_packet(), the wrapped-record length read from the wire is validated only against an upper bound. A small wire length (0, 1, or 2) produces an encrypted_buffer_count below the already-consumed encrypted_buffer_offset, causing an unsigned subtraction underflow in sasl_io_read_packet().…

M Alto vulnerabilidad

[CVE-2026-85436] MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPkt…

MOOS essential-moos through 10.0.1 contains a buffer overflow vulnerability in CMOOSUDPLink::ReadPktFromArray() that allows remote attackers to corrupt heap memory by sending UDP datagrams with negative declared lengths. Attackers can send crafted UDP packets to the configured UDPListen port to trigger an oversized memcpy operation that writes past the destination buffer, causing heap corruption a…

M Alto vulnerabilidad

Vulnerabilidad alta de subdesbordamiento entero en NASA cFS hasta versión 7.0.1

Se ha identificado una falla de seguridad en NASA cFS (Core Flight System) versiones hasta 7.0.1 en la función CFE_SB_GetUserDataLength del módulo cFE Software Bus. Un atacante remoto puede manipular los parámetros TotalMsgSize/HdrSize para provocar un subdesbordamiento entero, potencialmente comprometiendo sistemas aeroespaciales, satélites y aplicaciones embebidas altas en instituciones y empresas de LATAM. Con CVSS 7.4, este vector afecta directamente a organizaciones que utilizan sistemas de vuelo autónomo o infraestructura satelital.

M Alto vulnerabilidad

[CVE-2026-71442] CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that …

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

M Alto vulnerabilidad

[CVE-2026-16924] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of ser…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation.

1 2 3 Siguiente →