Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada hace 4 min

13,434

Total alertas

3054

Críticas

10108

Altas

8

Ransomware

1740

Esta semana

RSS

Vulnerabilidades × cwe-770 × Limpiar todo ×

M Alto vulnerabilidad

Vulnerabilidad alta en GStreamer gst-plugins-good permite denegación de servicio remota

Se encontró una falla en los componentes de depayload RTP (rtph264depay y rtph265depay) del paquete GStreamer gst-plugins-good que no valida límites máximos en el búfer de reensamblaje. Un atacante remoto sin autenticación puede enviar fragmentos RTP continuos sin marcadores de fin, agotando memoria y causando denegación de servicio en servidores multimedia, streaming en vivo y aplicaciones de videoconferencia operadas en infraestructuras en LATAM.

M Alto vulnerabilidad

[CVE-2026-71321] Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the…

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which …

M Alto vulnerabilidad

[CVE-2026-71314] Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an …

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, an unauthenticated attacker can use a server island v-for prop, including vforToArray and , to trigger unbounded SSR memory allocation until MAX_VFOR_LENGTH = 100000 and crash the Nuxt process. This issue is fixed in 3.21.10 and 4.5.1.

M Alto vulnerabilidad

[CVE-2026-59675] When API audit logging is enabled, the middleware reads the entire HTTP request body into memory wit…

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap (default 1 MiB) is bypassed for requests that pass through the audit copyReqBody path. An unauthenticated attacker can send…

M Alto vulnerabilidad

[CVE-2026-67592] It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling …

It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue

M Alto vulnerabilidad

[CVE-2026-69152] The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior…

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue i…

M Alto vulnerabilidad

Vulnerabilidad alta en FreeRDP anterior a 3.29.0 permite agotamiento de memoria

FreeRDP versiones anteriores a 3.29.0 no valida correctamente el límite de tamaño de respuestas HTTP con codificación chunked, permitiendo que un atacante con control de un RD Gateway malicioso agote los recursos de memoria del cliente. Esta vulnerabilidad afecta infraestructuras de escritorio remoto en empresas mexicanas y latinoamericanas que dependen de FreeRDP para acceso a servidores RDP.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-12733] IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper res…

IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.

M Alto vulnerabilidad

[CVE-2026-16308] IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus RES…

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes.

M Alto vulnerabilidad

[CVE-2026-11897] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of se…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.

M Alto vulnerabilidad

[CVE-2026-67437] OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17…

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. T…

M Alto vulnerabilidad

[CVE-2026-67432] MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.…

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process memory. This issue is fixed in version 0.23.0.

M Alto vulnerabilidad

[CVE-2026-15975] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 …

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to insufficient resource throttling when processing merge request discussions.

M Alto vulnerabilidad

[CVE-2026-15144] @fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned …

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range (a /64 holds 2^64 distinct addresses) and the same address has multiple valid textual representations, an IPv6 capable client can defeat the rate-limit boundary by rotating addresses or by rewriting the same address in d…

M Alto vulnerabilidad

[CVE-2026-54638] gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode …

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unauthenticated MTProto unencrypted packet and allocated make([]byte, dataLen) before checking the remaining buffer, allowing remote unauthenticated denial of service through excessive memory allocation and CPU or garbage colle…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-54609] QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0…

QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handleReconnectRequest forwards RECONNECT_REQUEST packets to the host without bounding them, so an unauthenticated client can drive relay-to-host amplification and cause a denial of service on the host. No fixed version is available as of this review.

M Alto vulnerabilidad

[CVE-2026-61609] Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authen…

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -…

M Alto vulnerabilidad

[CVE-2026-47483] NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where…

NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure.

A Alto vulnerabilidad

[CVE-2026-58389] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. …

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

A Alto vulnerabilidad

[CVE-2026-55968] Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerabili…

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

← Anterior 1 2 3 4 5 … 8 Siguiente →