Alertas de Seguridad de la Información

M Alto vulnerabilidad

21/09/2026

Vulnerabilidad alta en BioStar VIVID LED DJ 4.0.2411.1500 permite escritura arbitraria de memoria

Se detectó una vulnerabilidad de severidad alta (CVSS 8.8) en el controlador BS_LED64.sys del componente IOCTL Handler de BioStar VIVID LED DJ versión 4.0.2411.1500. La falla permite un ataque de write-what-where mediante manipulación del argumento AssociatedIrp, requiriendo acceso local. El exploit está públicamente disponible y representa riesgo inmediato para infraestructuras de entretenimiento y eventos en LATAM que utilicen este software.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

21/09/2026

Vulnerabilidad alta en BioStar VALKYRIE AURORA 2.10.2411.0800 permite escritura arbitraria de memoria

Se detectó una vulnerabilidad de escritura arbitraria (write-what-where) en el controlador BS_RVSIO64.sys del sistema de control de acceso BioStar VALKYRIE AURORA versión 2.10.2411.0800. La vulnerabilidad permite a un atacante local con acceso al sistema manipular la dirección física de memoria mediante el IOCTL Handler, comprometiendo la integridad del sistema de control biométrico. El exploit es público y activo.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

20/09/2026

[CVE-2026-93962] A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element …

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Up…

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

18/09/2026

[CVE-2026-93331] A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_par…

A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacketizer.c of the component RTP Depacketizer. Such manipulation of the argument size leads to out-of-bounds read. It is possible to launch the attack remotely. Upgrading to version abi-16.26 is able to resolve this issue. The name of the patch is 6bb0f64b4d1039c0…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-20352] A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthe…

A vulnerability in the RADIUS feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this vulnerability by sending a crafted RADIUS request directly to an affected device. A successful ex…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

16/09/2026

[CVE-2026-92399] A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame…

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 …

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-92178] pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This …

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-19886] OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This…

OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of O…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-92054] Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefo…

Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-91087] A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_i…

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4b…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

15/09/2026

[CVE-2026-90852] A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the func…

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.7-14 is able to resolve this issu…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

14/09/2026

Vulnerabilidad alta de Use After Free en Open5GS 2.7.x y anteriores

Se descubrió un fallo de seguridad (CVE-2026-90707, CVSS 8.3) en Open5GS que afecta la función amf_nnrf_try_old_amf_discovery_fallback, permitiendo ataques remotos de Use After Free mediante manipulación del parámetro discovery_option. Este componente es alta en infraestructuras 5G, poniendo en riesgo operadores de telecomunicaciones y proveedores de servicios móviles en LATAM que dependan de esta solución open source.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

14/09/2026

[CVE-2026-90689] A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the fun…

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuthWhiteUser. Performing a manipulation of the argument webAuthWhiteUserIndex results in stack-based buffer overflow. The attack can be initiated remotely.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

10/09/2026

[CVE-2026-87933] A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJS…

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

nvdaltovulnerabilidad CVSS 7.3 NVD

G Alto vulnerabilidad

09/09/2026

[CVE-2026-87489] Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potenti…

Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

G Alto vulnerabilidad

09/09/2026

[CVE-2026-87444] Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to exe…

Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

08/09/2026

[CVE-2026-86716] A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_c…

A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

07/09/2026

[CVE-2026-86303] A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Aff…

A vulnerability was determined in 92181 markdown up to 058cab0cb7fb245a0ccc6b8446963ff8d573558f. Affected by this issue is the function lds of the file md.c. Executing a manipulation can lead to out-of-bounds read. The attack can be executed remotely. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Thi…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

06/09/2026

Vulnerabilidad alta de desbordamiento de buffer en Tenda HG10 300001138

Se identificó una vulnerabilidad en el componente Boa Web Server del router Tenda HG10 (modelo 300001138) que permite desbordamiento de buffer mediante manipulación del parámetro 'if' en la función formWanRedirect. El exploit ha sido divulgado públicamente y puede ser explotado de forma remota. Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en México y Latinoamérica que utilizan este dispositivo como router de acceso a Internet o en infraestructuras de red.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

03/09/2026

[CVE-2026-85110] A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of th…

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the component Boa Web Server. The manipulation of the argument ssid leads to buffer overflow. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

nvdaltovulnerabilidad CVSS 8.8 NVD