Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

Buscando: "Ui" — 2264 resultados ✕ Limpiar búsqueda

13,598

Total alertas

3086

Críticas

10240

Altas

8

Ransomware

1809

Esta semana

RSS

Vulnerabilidades × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-11794] The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not re…

The Advanced Form Integration — Connect Forms to 200+ Apps WordPress plugin before 2.1.1 does not restrict the WordPress role assigned when it creates a user from a public form submission, allowing unauthenticated visitors to create an administrator account when an active integration maps the user role to a public form field. This requires a specific, non-default multi-Advanced Form Integration — …

M Alto vulnerabilidad

[CVE-2026-11883] The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the s…

The WebAuthn Provider for Two Factor WordPress plugin before 2.5.6 does not correctly validate the second-factor authentication response, allowing an attacker who already knows a user's password to bypass the two-factor authentication requirement by submitting a malformed request.

M Alto vulnerabilidad

[CVE-2026-1239] The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to…

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.

U Alto vulnerabilidad

[CVE-2026-7829] UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/de…

UltraVNC repeater through 1.8.2.2 contains a post-authentication out-of-bounds write in the allow/deny rule parser. In repeater/webgui/settings.c:225-272, after strncpy_s copies a rule token into temp1[rule1] (25-byte destination) or temp2/temp3 (16-byte destination), the code unconditionally writes a NUL terminator at temp1[rule1][len] = 0 without clamping len to the destination size. When an aut…

U Crítico vulnerabilidad

[CVE-2026-7839] UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded defaul…

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpy_s(saved_password, 64, "adminadmi2"). The HTTP Basic-auth handler wi_decode_auth() checks this password without rate-limiting o…

U Crítico vulnerabilidad

[CVE-2026-7840] UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administrat…

UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_replyhdr() in repeater/webgui/webutils.c write the caller-supplied HTTP request URI into a fixed 1000-byte global buffer (hdrbuf) via unchecked sprintf calls. The HTTP receive buffer accepts URIs up to approximately 150 KB (WI_RXBUFSIZE = 153600), so an …

M Alto vulnerabilidad

[CVE-2026-13468] The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerab…

The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access and export the contents of any visualizer chart on the site — includ…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-56300] Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_or…

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine permission levels, significantly increasing the actionability of compromised credentials.

M Alto vulnerabilidad

[CVE-2026-56233] Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allow…

Capgo before 12.128.2 contains a path traversal vulnerability in the builder upload proxy that allows authenticated users with build permissions to bypass upload restrictions. Attackers can append traversal sequences to the upload path, which are normalized by the WHATWG URL parser, enabling access to internal administrative endpoints with the privileged BUILDER_API_KEY header and resulting in ser…

M Alto vulnerabilidad

[CVE-2026-54672] electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets …

electron-updater allows for automatic updates for Electron apps. Prior to 26.15.0, AppImage targets built by app-builder-lib could use an empty path component when setting the LD_LIBRARY_PATH environment variable at runtime. This causes the current working directory to be added to the dynamic linker search path, which may allow an attacker to execute arbitrary code by placing a malicious shared li…

G Alto vulnerabilidad

[CVE-2026-14114] Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 al…

Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-14099] Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-14064] Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attac…

Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-14024] Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker w…

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

G Alto vulnerabilidad

[CVE-2026-14025] Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who…

Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

G Alto vulnerabilidad

[CVE-2026-14027] Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convi…

Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-14005] Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attack…

Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

G Alto vulnerabilidad

[CVE-2026-13968] Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allow…

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: Medium)

G Alto vulnerabilidad

[CVE-2026-13925] Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed…

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

G Alto vulnerabilidad

[CVE-2026-13927] Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 …

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

← Anterior 1 … 79 80 81 82 83 … 114 Siguiente →