Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,598

Total alertas

3086

Críticas

10240

Altas

8

Ransomware

1806

Esta semana

RSS

Vulnerabilidades × critico × Limpiar todo ×

M Crítico vulnerabilidad

[CVE-2026-57692] Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. T…

Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Escalation. This issue affects PrivateContent: from n/a through 9.9.2.

L Crítico vulnerabilidad

[CVE-2026-53355] In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setu…

In the Linux kernel, the following vulnerability has been resolved: net: rds: clear i_sends on setup unwind The RDS IB connection teardown path is written so it can run during partial startup and on repeated shutdown attempts. It uses NULL pointers to distinguish resources that are still owned from resources that have already been released. When rds_ib_setup_qp() fails after allocating i_sends …

F Crítico vulnerabilidad

[CVE-2026-14198] @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter valu…

@fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorizatio…

M Crítico vulnerabilidad

[CVE-2026-10539] A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied inpu…

A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthenticated attacker to execute unauthorized commands on the affected server, potentially leading to compromise of the server. This vulnerability affects Control-M/Server versions 9.0.20.x to 9.0.21.200 (included) and potentially earlier u…

M Crítico vulnerabilidad

[CVE-2026-11387] The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for …

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full a…

U Crítico vulnerabilidad

[CVE-2026-7839] UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded defaul…

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting o…

U Crítico vulnerabilidad

[CVE-2026-7840] UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administrat…

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an …

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

[CVE-2026-6070] The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deleti…

The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including 4.0.1. This is due to insufficient path validation in the remove() method of the JBusinessDirectoryControllerUpload class. The task=upload.remove endpoint is accessible without authentication via the plugin's frontend routing system. The _filename parameter is acce…

M Crítico vulnerabilidad

[CVE-2026-56413] Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl ser…

Storage Concentrator (SC & SCVM) contains a command injection vulnerability in the ms_service.pl service, which listens on TCP port 9000 by default and accepts custom network packets to perform device actions. An unauthenticated remote attacker can send a specially crafted packet containing a malicious payload that is processed without adequate sanitization, resulting in arbitrary command executio…

M Crítico vulnerabilidad

[CVE-2026-56415] Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl scri…

Storage Concentrator (SC & SCVM) contains a command injection vulnerability within the debug.pl script that is reachable without authentication. A remote attacker can submit a specially crafted HTTP request containing a malicious payload that is processed without adequate input sanitization, resulting in arbitrary command execution with root-level privileges on the underlying system.

M Crítico vulnerabilidad

[CVE-2026-56700] Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserial…

Grav CMS before 2.0.0-beta.2 contains multiple code-execution vulnerabilities. Three unsafe unserialize() calls - in Scheduler\JobQueue, Framework\Cache\Adapter\FileCache, and Session - deserialize untrusted data without restricting allowed classes, enabling PHP object injection and, via a gadget chain, arbitrary code execution where an attacker controls the serialized input. Additionally, Install…

F Crítico vulnerabilidad

[CVE-2026-56278] Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('f…

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses a weak hardcoded default secret ('flowise') for the express-session middleware when the EXPRESS_SESSION_SECRET environment variable is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because this default secret is publicly visible in the source code, an attacker can forge valid signed session cookies to imperso…

M Crítico vulnerabilidad

[CVE-2026-55721] Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by t…

Storage Concentrator (SC & SCVM) is vulnerable to SQL injection through cookie values processed by the login.pl and debug.pl scripts. The cookie value is incorporated directly into database queries without adequate sanitization, allowing an unauthenticated remote attacker to manipulate those queries and extract sensitive information from the underlying database, including session tokens, password …

M Crítico vulnerabilidad

[CVE-2026-50110] Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embed…

Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While the credentials are stored in an encoded format, the encoding can be reversed to plaintext. The exposed credentials span a broad range of internal services, including database accounts, licensing, replication services, and third-party integrations, meaning succ…

G Crítico vulnerabilidad

[CVE-2026-14152] Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attac…

Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

G Crítico vulnerabilidad

[CVE-2026-14113] Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attack…

Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

G Crítico vulnerabilidad

[CVE-2026-14120] Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote at…

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

G Crítico vulnerabilidad

[CVE-2026-14121] Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attac…

Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

G Crítico vulnerabilidad

[CVE-2026-14101] Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a …

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

G Crítico vulnerabilidad

[CVE-2026-14104] Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47…

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

← Anterior 1 … 104 105 106 107 108 … 149 Siguiente →