Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

Buscando: "Ni" — 4177 resultados ✕ Limpiar búsqueda

13,566

Total alertas

3081

Críticas

10213

Altas

8

Ransomware

1781

Esta semana

RSS

Vulnerabilidades × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-11344] A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown fu…

A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.

M Crítico vulnerabilidad

[CVE-2025-71317] NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants…

NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrat…

M Crítico vulnerabilidad

[CVE-2025-71318] NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remo…

NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — includin…

M Alto vulnerabilidad

[CVE-2025-5088] An authenticated Redis session could be used to obtain full root access to all servers in the CVX cl…

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

B Crítico vulnerabilidad

[CVE-2026-11362] DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog:…

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metr…

B Crítico vulnerabilidad

[CVE-2026-9270] DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does …

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta v…

7 Alto vulnerabilidad

[CVE-2026-48095] 7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buff…

7-Zip is a file archiver with a high compression ratio. Versions 26.00 and prior contain a heap buffer overflow vulnerability caused by an under-allocation in the NTFS compressed stream buffer (GetCuSize shift UB), potentially allowing attackers to cause arbitrary code execution or application crashes. CInStream::GetCuSize() in the NTFS handler computes the compression-unit buffer size as (UInt32)…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-11334] A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec8…

A vulnerability was detected in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. This affects an unknown function of the file dashboard_page/forms/fetch.php. Performing a manipulation of the argument department_code results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Conti…

M Alto vulnerabilidad

[CVE-2026-50234] Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attack…

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web server context. Attackers can manipulate file path parameters to access sensitive files outside the intended directory structure.

X Alto vulnerabilidad

[CVE-2026-50258] A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has mu…

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may…

G Alto vulnerabilidad

Vulnerabilidad alta en Android OS (CVE-2026-21029) con CVSS 7.8 afecta dispositivos en LATAM

Google Android ha publicado un advisory sobre una vulnerabilidad de severidad alta (CVSS 7.8) en Android OS que impacta millones de dispositivos móviles en México y Latinoamérica, representando más del 80% del parque móvil regional. Esta falla de seguridad requiere actualización inmediata en todos los equipos corporativos y personales para prevenir explotación remota.

M Crítico vulnerabilidad

[CVE-2026-6274] Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerabi…

Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8.

M Crítico vulnerabilidad

[CVE-2026-7762] A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micr…

A heap-based buffer overflow vulnerability in the dot11ah.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon or probe response frame containing a malformed S1G Capabilities Information El…

M Crítico vulnerabilidad

[CVE-2026-7763] A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro …

A heap-based buffer overflow vulnerability in the morse.ko HaLow Wi-Fi kernel driver in Morse Micro HaLowLink 2 software versions prior to 2.11.13 allows an unauthenticated attacker within radio range to cause a Denial of Service (kernel panic) or potentially achieve Remote Code Execution via a crafted 802.11ah beacon frame containing a malformed Traffic Indication Map (TIM) Information Element. T…

G Alto vulnerabilidad

Escalación de privilegios alta en Android OS (CVE-2026-11295) - CVSS 8.8

Vulnerabilidad de escalación de privilegios en Android OS con puntuación CVSS 8.8 afecta dispositivos móviles en México y Latinoamérica, representando riesgo significativo para más del 80% del parque móvil regional. Un atacante podría obtener permisos elevados sin autenticación explícita del usuario. La actualización de seguridad está disponible mediante el canal oficial de Google.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-10877] A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up…

A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System up to 1.0. This impacts an unknown function of the file /admin/login.php of the component Admin Login. Such manipulation of the argument Username leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

S Alto vulnerabilidad

Vulnerabilidad crítica en SolarWinds Serv-U bajo explotación activa

CISA confirma explotación activa de CVE-2026-28318 en SolarWinds Serv-U, software ampliamente deployado en infraestructuras de LATAM para transferencia de archivos segura. No se han reportado usos en campañas de ransomware conocidas hasta el momento. La remediación debe completarse antes del 19 de junio de 2026 según directiva CISA BOD 22-01.

G Alto vulnerabilidad

Vulnerabilidad alta Use-After-Free en Android OS (CVE-2026-11188) - CVSS 8.8

Se ha identificado una vulnerabilidad de Use-After-Free (UAF) de severidad alta en Android OS con puntuación CVSS 8.8. Esta afecta a más del 80% de dispositivos móviles en México y Latinoamérica, exponiendo sistemas a ejecución de código remoto y escalada de privilegios. La explotación puede comprometer datos corporativos y acceso a aplicaciones sensibles en entornos empresariales.

G Alto vulnerabilidad

[CVE-2026-11177] Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who conv…

Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

G Crítico vulnerabilidad

Vulnerabilidad crítica en Android OS (CVE-2026-11167) - CVSS 9.6

Google publicó un parche de seguridad para una vulnerabilidad crítica en Android OS con puntuación CVSS 9.6. La falla afecta más del 80% de dispositivos móviles en México y Latinoamérica, exponiendo sistemas corporativos y personales a explotación remota. Se recomienda actualización inmediata en todos los terminales.

← Anterior 1 … 192 193 194 195 196 … 209 Siguiente →