Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,181

Total alertas

4701

Críticas

16892

Altas

8

Ransomware

1055

Esta semana

RSS

Alta × cwe-502 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2025-71374] picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used …

picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files that bypass picklescan detection and achieve code execution upon deserialization.

I Alto vulnerabilidad

[CVE-2026-13759] IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObje…

IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-lo…

M Alto vulnerabilidad

[CVE-2026-12240] The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficie…

The Export User Data plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unserialize function in all versions up to, and including, 2.2.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is …

M Alto vulnerabilidad

[CVE-2026-57527] Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulner…

Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to Objec…

M Alto vulnerabilidad

[CVE-2026-56055] Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Subscriber PHP Object Injection in RealHomes

M Alto vulnerabilidad

[CVE-2026-56031] Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.

Unauthenticated PHP Object Injection in Uncanny Automator

M Alto vulnerabilidad

[CVE-2025-71340] picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.Modifie…

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-46607] Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py…

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, glances/outdated.py uses pickle.load() to read a version-check cache file stored at a predictable, world-accessible path (~/.cache/glances/glances-version.db or $XDG_CACHE_HOME/glances/glances-version.db). No integrity check, signature verification, or format validation is performed before deserialization. An attacker…

M Alto vulnerabilidad

[CVE-2026-56053] Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.

Subscriber PHP Object Injection in EventPrime

M Alto vulnerabilidad

[CVE-2026-10043] MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulner…

MosaicML Composer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MosaicML Composer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. T…

M Alto vulnerabilidad

[CVE-2025-71354] picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.Object…

picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

F Alto vulnerabilidad

[CVE-2026-54512] jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson …

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains …

M Alto vulnerabilidad

[CVE-2026-41862] Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialis…

Spring Statemachine's Kryo-based persistence backends (JPA, MongoDB, Redis and ZooKeeper) deserialise persisted state-machine contexts without enforcing a class allowlist (CWE-502, deserialisation of untrusted data), which can lead to remote code execution inside the application JVM. Affected versions: Spring Statemachine 4.0.0 through 4.0.1 Spring Statemachine 3.2.0 through 3.2.4

M Alto vulnerabilidad

[CVE-2026-39253] An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivot…

An issue in Pivotal CRM v.6.6.04.08 allows a remote attacker to execute arbitrary code via the Pivotal.Core.Common.dll and Pivotal.Engine.Client.Services.Conversion.dll components.

M Alto vulnerabilidad

[CVE-2025-71341] picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle f…

picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code. Remote attackers can craft malicious pickle files using profile.Profile.runctx in the reduce method to achieve remote code execution when the pickle file is loaded.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2025-71365] picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.…

picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can craft malicious pickle files embedding arbitrary code that evades picklescan detection and executes remote code when loaded.

M Alto vulnerabilidad

[CVE-2025-71370] picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper func…

picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft malicious pickle files that bypass picklescan detection and execute arbitrary code when loaded via pickle.load().

M Alto vulnerabilidad

[CVE-2025-71376] picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoCompl…

picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when loaded by victims.

M Alto vulnerabilidad

[CVE-2026-48517] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CShar…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's typeless deserialization includes MessagePackSerializerOptions.ThrowIfDeserializingTypeIsDisallowed(Type) as a safety check for dangerous types. The default implementation checks the outer type name, but it does not recursively inspect array element types or generic type arguments. As a result, …

M Alto vulnerabilidad

[CVE-2026-48502] MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader…

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is valid…

← Anterior 1 … 13 14 15 16 17 … 19 Siguiente →