Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,434

Total alertas

3054

Críticas

10108

Altas

8

Ransomware

1778

Esta semana

RSS

Vulnerabilidades × Alta × cwe-798 × Limpiar todo ×

M Alto vulnerabilidad

Vulnerabilidad alta en vas3k TaxHacker permite credenciales hardcodeadas en JWT

Se identificó una vulnerabilidad en vas3k TaxHacker versiones hasta 0.8.2 en el manejador JWT Secret (función envSchema.parse) que permite manipular el parámetro BETTER_AUTH_SECRET, resultando en credenciales hardcodeadas. El ataque es remoto y afecta directamente la autenticación de aplicaciones financieras y de gestión tributaria. Aunque se notificó al desarrollador, no ha respondido con parches disponibles.

M Alto vulnerabilidad

Vulnerabilidad alta en openssl_encrypt: clave secreta hardcodeada compromete autenticación de API

Versiones de openssl_encrypt anteriores a 1.4.0 contienen una clave secreta predeterminada hardcodeada en la configuración del servidor de telemetría, usada para hash de claves API. Atacantes que conocen este valor pueden falsificar hashes de API para comprometer la autenticación del sistema de telemetría. Esto afecta directamente a infraestructuras en la nube y servidores locales que dependen de esta validación criptográfica.

M Alto vulnerabilidad

Vulnerabilidad alta en openssl_encrypt: secretos JWT hardcodeados permiten falsificación de tokens

Versiones de openssl_encrypt anteriores a 1.4.0 contienen secretos de firma JWT hardcodeados en config.py que superan validaciones, permitiendo a atacantes con acceso al código fuente forjar tokens válidos para cualquier client_id y acceder sin autorización a APIs de keyserver y telemetría. Afecta especialmente a organizaciones en LATAM que utilizan esta librería en aplicaciones de autenticación y gestión de claves.

M Alto vulnerabilidad

[CVE-2026-19901] A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown functi…

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The …

M Alto vulnerabilidad

[CVE-2026-19900] A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown …

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is regarded as difficult. The exploit is publicly available and might be used. The vendor was c…

M Alto vulnerabilidad

[CVE-2026-18164] An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentic…

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

M Alto vulnerabilidad

[CVE-2026-13460] IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded toke…

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-14866] IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certifica…

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.

M Alto vulnerabilidad

[CVE-2026-6374] Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constant…

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.

M Alto vulnerabilidad

Exposición de credenciales en firmware de dispositivos - CVE-2026-49007 (CVSS 7.5)

Vulnerabilidad que permite a atacantes acceder a credenciales iniciales de dispositivos al leer información sin encriptar en el firmware. Afecta múltiples fabricantes y expone interfaces web administrativas. En LATAM, esta falla impacta servidores, equipos de red y sistemas embebidos en infraestructuras altas.

M Alto vulnerabilidad

[CVE-2026-65313] A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations …

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

M Alto vulnerabilidad

[CVE-2026-13463] IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the…

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.

M Alto vulnerabilidad

[CVE-2021-32085] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with …

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for o…

M Alto vulnerabilidad

[CVE-2021-32087] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with …

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileg…

M Alto vulnerabilidad

[CVE-2026-47255] AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to versio…

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed ou…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

D Alto vulnerabilidad

[CVE-2026-31928] The DMP-5000 devices are shipped with a default administrative web account with weak authentication …

The DMP-5000 devices are shipped with a default administrative web account with weak authentication controls, which are not required to be changed during initial configuration or operation. Using these accounts provides full system access.

M Alto vulnerabilidad

[CVE-2026-22312] The device has a webserver that exposes a REST API authenticated with a constant token. The unauthen…

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands (e.g. system reboot).

A Alto vulnerabilidad

[CVE-2026-50213] The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, wh…

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predictable identification strings.

S Alto vulnerabilidad

[CVE-2026-8876] Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in secur…

Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis alert keyword data and intervention site data.

M Alto vulnerabilidad

[CVE-2026-36606] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with …

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who obtains a backup file can decrypt it to recover all stored credentials including admin password, WiFi PSK, and DDNS credentials.

1 2 Siguiente →