Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,181

Total alertas

4701

Críticas

16892

Altas

8

Ransomware

1055

Esta semana

RSS

Alta × cwe-416 × Limpiar todo ×

M Alto vulnerabilidad

Vulnerabilidad alta en FreeRDP anterior a 3.29.0 permite ejecución de código en clientes

FreeRDP antes de la versión 3.29.0 contiene un defecto de use-after-free en memoria del lado cliente que afecta el procesamiento de mensajes asincronos WINDOW_ICON_ORDER cuando la actualización asincrónica está habilitada. Un atacante puede explotar esta vulnerabilidad para ejecutar código arbitrario en sistemas que utilizan xfreerdp con flags /async-update. La falla impacta infraestructuras de escritorio remoto en empresas LATAM que dependen de FreeRDP para acceso remoto seguro.

M Alto vulnerabilidad

Vulnerabilidad alta en FreeRDP: uso de memoria liberada en cliente RDP

FreeRDP anterior a versión 3.29.0 contiene vulnerabilidades de uso de memoria liberada (heap use-after-free) en el lado del cliente cuando AsyncUpdate está habilitado. Un servidor RDP malicioso o comprometido puede enviar órdenes de actualización manipuladas que explotan copias superficiales de estructuras con punteros anidados, afectando órdenes RAIL WINDOW_STATE_ORDER y NOTIFY_ICON_STATE_ORDER. Empresas en LATAM que usan FreeRDP como cliente RDP o en soluciones de acceso remoto están expuestas a ejecución de código arbitrario.

M Alto vulnerabilidad

[CVE-2026-10685] The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth…

The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback with NULL data is the documented signal that the subscription has terminated and the bt_gatt_subscribe_params struct may …

M Alto vulnerabilidad

[CVE-2026-63035] A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an …

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

G Alto vulnerabilidad

[CVE-2026-18017] Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute …

Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

G Alto vulnerabilidad

[CVE-2026-18012] Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

M Alto vulnerabilidad

[CVE-2026-17967] Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote att…

Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-17920] Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a use…

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

M Alto vulnerabilidad

[CVE-2026-17918] Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute …

Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

M Alto vulnerabilidad

[CVE-2026-17894] Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker t…

Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17896] Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to exec…

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17898] Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced…

Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)

M Alto vulnerabilidad

[CVE-2026-17881] Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execu…

Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17884] Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker t…

Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17886] Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to po…

Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-17887] Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who con…

Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17875] Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execut…

Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17862] Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacke…

Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17836] Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

M Alto vulnerabilidad

[CVE-2026-17807] Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute ar…

Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

← Anterior 1 … 21 22 23 24 25 … 52 Siguiente →