Alertas de Seguridad de la Información

M Crítico vulnerabilidad

28/09/2026

Vulnerabilidad crítica en FAST FAC1900R 20190827_2.0.2 permite desbordamiento de búfer remoto

Se identificó un desbordamiento de búfer basado en pila (stack-based buffer overflow) en la función copy_msg_element del servicio devdiscover de FAST FAC1900R versión 20190827_2.0.2. La vulnerabilidad permite ejecución remota de código sin autenticación (CVSS 10.0) y cuenta con exploits públicamente disponibles. El fabricante no ha respondido a reportes de divulgación responsable, elevando el riesgo inmediato para infraestructuras que dependan de este dispositivo en centros de datos y operaciones críticas de LATAM.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

28/09/2026

Inyección de comandos alta en ManageEngine DDI Central < 6201 permite ejecución remota

ManageEngine DDI Central en versiones anteriores a 6201 contiene una vulnerabilidad de inyección de comandos en el campo de nombre de política de resolución DNS de Windows, permitiendo la ejecución remota de código con score CVSS 7.2. Esta afecta directamente infraestructuras DNS gestionadas por empresas en México y Latinoamérica que utilizan esta solución de gestión de direcciones IP. Un atacante podría ejecutar comandos arbitrarios en servidores Windows con permisos del servicio DDI Central.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Crítico vulnerabilidad

28/09/2026

Vulnerabilidad crítica de desbordamiento de búfer en FAST FAC1200R 5.0

Se ha identificado un desbordamiento de búfer basado en pila (stack-based buffer overflow) en la función parse_advertisement_frame del servicio devdiscover del dispositivo FAST FAC1200R versión 5.0_20201119_1.0.2, con puntuación CVSS 9.9. La vulnerabilidad puede ser explotada remotamente sin autenticación, permitiendo ejecución de código arbitrario en routers empresariales y de pequeños negocios ampliamente desplegados en México y Latinoamérica. El exploit es público y el fabricante no ha respondido a solicitudes de parche.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad de lectura fuera de límites en libXtst 1.2.5 y anteriores

Se identificó una vulnerabilidad de lectura fuera de límites (out-of-bounds read) en el analizador de respuestas RECORD de libXtst anterior a versión 1.2.6. Un servidor X malicioso podría explotar esta falla para provocar el bloqueo (denial of service) de clientes X conectados. Esta vulnerabilidad afecta principalmente a entornos de infraestructura de escritorio remoto y sistemas con autenticación X11, comunes en infraestructura empresarial de LATAM.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad de desbordamiento de búfer en productos Wi-Fi BUFFALO permite denegación de servicio

Existe una vulnerabilidad de desbordamiento de búfer basado en pila en equipos Wi-Fi BUFFALO que permite a un atacante no autenticado enviar solicitudes HTTP especialmente diseñadas para provocar una denegación de servicio (DoS). Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan routers y puntos de acceso BUFFALO en sus infraestructuras de red corporativa e ISP.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta de carga de archivos en eBA Plus permite inyección de web shells

eBA Plus Document and Workflow Management System (versiones 6.7.141 a 10.0.10) contiene una vulnerabilidad de carga sin restricciones que permite a atacantes subir archivos ejecutables y comprometer servidores web. Este sistema es utilizado por organismos públicos y empresas en México y LATAM para gestión documental; su explotación puede resultar en acceso no autorizado y control total del servidor.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad alta en productos Wi-Fi BUFFALO permite ejecución remota de comandos

BUFFALO Wi-Fi products procesa incorrectamente entradas en formularios web para construir cadenas de comandos del sistema operativo, permitiendo a usuarios administrativos ejecutar comandos OS arbitrarios mediante solicitudes HTTP maliciosamente elaboradas. Afecta principalmente a infraestructuras de conectividad en pequeñas y medianas empresas (PYMES) de México y Latinoamérica que utilizan equipos BUFFALO para redes corporativas.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/09/2026

Vulnerabilidad de validación en OpenDMARC afecta autenticación de correo en servidores hasta versión 1.4.2

Se ha identificado una falla en Trusted Domain Project OpenDMARC versiones hasta 1.4.2 que permite eludir validaciones de equivalencia en el componente Domain Handler (archivo policy.c). La vulnerabilidad puede explotarse remotamente y afecta la autenticación DMARC de correos electrónicos en servidores de correo, con riesgo de suplantación de dominios. Empresas en LATAM que usan OpenDMARC deben aplicar actualizaciones urgentes, especialmente aquellas que procesan comunicaciones altas.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101014] A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulne…

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-82384] Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker t…

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing, before authentication. The servlet is mapped unconditionally, so parsing occurs even when the global XML-RPC feature is set to disabled; no …

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82386] Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog adminis…

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a crafted OPML document, because the bookmark import parser does not disable external entity resolution. No non-default configuration is required; the import is reached through the administrator boo…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82376] Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entr…

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of files readable by the Roller process. The Trackback control is hidden in the standard UI, but its action r…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-82377] Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete…

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting ar…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-82379] Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a val…

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations that enable the non-default AtomPub API with WSSE authentication and plaintext-compatible password storag…

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101012] A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d6…

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file makeresult.php. This manipulation of the argument makeid causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling re…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101013] A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec09…

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updateresultdetails.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101007] A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputS…

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101008] A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file o…

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted ear…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101009] A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function p…

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendo…

nvdaltovulnerabilidad CVSS 8.4 NVD

M Alto vulnerabilidad

28/09/2026

[CVE-2026-101005] A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalI…

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 4.3.5 is able to mitigate this issue. You should upgrad…

nvdaltovulnerabilidad CVSS 7.3 NVD