Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada hace 2 horas

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1002

Esta semana

RSS

Vulnerabilidades × Alta × cwe-470 × Limpiar todo ×

M Alto vulnerabilidad Nuevo

[CVE-2026-104629] A component loading mechanism in openPDC and openHistorian will construct and run any specified type…

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.

M Alto vulnerabilidad

[CVE-2026-106510] Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugi…

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by remote code execution via crafted markdown_extensions in techdocs mkdocs.yml. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml causing arbitrary OS command execution on the TechDocs build host when the docs are built. Thi…

M Alto vulnerabilidad

[CVE-2026-106440] Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.…

Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper package accepts a configuration-controlled dotted path in hydra.sweeper.custom_search_space, resolves it with hydra.utils.get_method(), and later invokes the returned callable in the Hydra controller process. Because get_method() is a trusted-input lookup helper and…

M Alto vulnerabilidad

[CVE-2026-105782] Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, Refe…

Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path as a referrer policy class, imported the referenced object, and called it. A malicious website could supply a callable such as sys.exit and terminate a crawler pro…

M Alto vulnerabilidad

[CVE-2026-102094] Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does …

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Unsafe Reflection and does not sufficiently restrict the code that the mail-processing pipeline could load from an imported rule configuration. An authenticated administrator with mail-rule configuration privileges could cause the gateway to load and execute code beyond the approved set of mail-processing components, potentia…

M Alto vulnerabilidad

[CVE-2026-100308] Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 mig…

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

M Alto vulnerabilidad

[CVE-2026-101292] Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStrea…

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol wire buffer without type validation. An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class n…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-18123] IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause …

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to the improper use of reflection with externally controlled input.

M Alto vulnerabilidad

[CVE-2026-70410] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in …

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Class.forName(String) which by default triggers initialization. This may lead to the execution of static initializer blocks in arbitrary classes…

M Alto vulnerabilidad

[CVE-2026-10853] IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or pot…

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to improper validation of cluster command message lengths.

M Alto vulnerabilidad

[CVE-2026-66269] Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Contr…

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

M Alto vulnerabilidad

[CVE-2026-76825] RestrictedPython is a tool that helps define a subset of the Python language for accepting program i…

RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter class, a Formatter instance, or a Formatter subclass to restricted code. The string.Formatter methods for…

M Alto vulnerabilidad

[CVE-2026-79987] A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission ca…

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

M Alto vulnerabilidad

[CVE-2026-79784] Vocos instantiates a class named by a configuration file without restricting which class may be name…

Vocos instantiates a class named by a configuration file without restricting which class may be named. instantiate_class in vocos/pretrained.py takes the class_path value from the configuration, splits it into a module and an attribute, imports the module with __import__, resolves the attribute with getattr, and calls the result as args_class(*args, **kwargs) where kwargs is the config's own init_…

M Alto vulnerabilidad

[CVE-2026-68508] Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.ins…

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader th…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-8400] IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continu…

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes.

M Alto vulnerabilidad

[CVE-2026-6020] The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoro…

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handle_action() method passing user-supplied input directly to call_user_func() without an allowlist of permitted callbacks. This makes it possible for authenticated attackers, with Administrator-le…

M Alto vulnerabilidad

[CVE-2026-61536] Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3,…

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Py…

M Alto vulnerabilidad

[CVE-2026-65608] Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory…

Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is callable (is_callable()) without restricting dangerous functions such as exec, system, passthru, or shell_exec. Because FlexDirectory registe…

M Alto vulnerabilidad

[CVE-2026-13187] In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tam…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

1 2 Siguiente →