Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,434

Total alertas

3054

Críticas

10108

Altas

8

Ransomware

1778

Esta semana

RSS

Alta × cwe-73 × Limpiar todo ×

M Alto vulnerabilidad Nuevo

[CVE-2026-78208] exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() fun…

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

M Alto vulnerabilidad

[CVE-2026-64679] Atlantis is a self-hosted golang application that listens for Terraform pull request events via webh…

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended …

M Alto vulnerabilidad

[CVE-2026-77176] A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containe…

A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitrary container-rootfs paths over sensitive host locations or provision arbitrary content, potentially exposing confidential information or ena…

M Alto vulnerabilidad

[CVE-2026-52872] Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2…

Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2.5.0, the downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to fs.copyFileSync. The renderer also controls downloadPath, which determines the destinat…

M Alto vulnerabilidad

[CVE-2026-48798] SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string…

SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to c…

M Alto vulnerabilidad

[CVE-2026-75830] grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path tra…

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and

M Alto vulnerabilidad

[CVE-2026-46345] compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a…

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the iss…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-16137] In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credential…

In Progress ShareFile Storage Zones Controller v5.12.5 and below, a party with valid zone credentials can perform path traversal using resumable upload initiation endpoint, allowing the party to write arbitrary content to any location writable by the application's service account. This may result in the execution of attacker-supplied code.

M Alto vulnerabilidad

[CVE-2026-16139] In Progress ShareFile Storage Zones Controller versions <= 5.12.5 and <= 6.0.2, an authenticated zon…

In Progress ShareFile Storage Zones Controller versions

M Alto vulnerabilidad

Vulnerabilidad alta de path traversal en openssl_encrypt anteriores a v1.4.0

openssl_encrypt versiones anteriores a 1.4.0 contienen una vulnerabilidad de path traversal (CVE-2026-74884, CVSS 7.5) en el método _is_safe_path que no sanitiza el parámetro plugin_id, permitiendo a atacantes acceder a directorios arbitrarios fuera del directorio de plugins mediante secuencias como '../'. Empresas en México y LATAM que usen este componente en aplicaciones web o sistemas de gestión de contenido enfrentan riesgo de exposición de información sensible y potencial ejecución de código.

M Alto vulnerabilidad

[CVE-2026-16987] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to imprope…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

M Alto vulnerabilidad

[CVE-2026-16898] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

M Alto vulnerabilidad

[CVE-2026-65941] In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network a…

In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account.

M Alto vulnerabilidad

[CVE-2026-18048] The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled val…

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.

M Alto vulnerabilidad

[CVE-2026-72742] DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters…

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The JSONAdapter and ChatAdapter parse untrusted language model completions through parse_value into TypeAdapter v…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-18127] External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows…

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage.

M Alto vulnerabilidad

Inclusión de archivos en TinyAGI 0.0.20 permite acceso remoto no autorizado

Se identificó una vulnerabilidad alta en TinyAGI versión 0.0.20 que afecta la función collectFiles del componente Message API Endpoint, permitiendo la manipulación remota e inclusión de archivos arbitrarios. El exploit está disponible públicamente y representa un riesgo inmediato para infraestructuras que utilizan esta librería en aplicaciones de IA generativa. Empresas en LATAM que implementen TinyAGI en producción deben considerar este defecto como prioritario dado el acceso remoto sin autenticación requerida.

M Alto vulnerabilidad

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

M Alto vulnerabilidad

[CVE-2026-15307] An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups …

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lookup against a `GeometryField` or `RasterField` reaches this constructor, including untrusted input, for example a spatial-field filter subm…

M Alto vulnerabilidad

[CVE-2026-18806] External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research…

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4.

1 2 3 Siguiente →