Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/08/2026

Inyección de comandos alta en TOTOLIK N600R 4.3.0cu.7647_B20210106

Se detectó una vulnerabilidad de inyección de comandos en routers TOTOLINK N600R versión 4.3.0cu.7647_B20210106 a través del parámetro ntp_server en /cgi-bin/cstecgi.cgi. Un atacante remoto puede ejecutar comandos arbitrarios sin autenticación, comprometiendo completamente el dispositivo. Esta vulnerabilidad afecta especialmente a PyMEs y centros de datos en LATAM que usan estos equipos como punto de acceso o pasarela de red.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

Inyección de plantillas en Compliance-trestle permite ejecución remota de código

Compliance-trestle (versiones anteriores a 3.12.4 y 4.0.0-4.0.3) contiene una vulnerabilidad de inyección de plantillas del lado del servidor en las etiquetas Jinja2 MDCleanInclude y MDSectionInclude. Un atacante puede ejecutar código arbitrario reparseando contenido Markdown no confiable como código fuente de plantilla. Afecta a organizaciones que utilizan Trestle para gestionar documentos de cumplimiento OSCAL en México y LATAM.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta de buffer overflow en BlueZ afecta stack Bluetooth de Linux

Una vulnerabilidad de desbordamiento de búfer en la pila Bluetooth de Linux (BlueZ) permite a atacantes remotos dentro del rango de radio enviar paquetes Extended Inquiry Response (EIR) malformados que causan bloqueos del servicio bluetoothd. Afecta servidores Linux, dispositivos IoT y sistemas embebidos comunes en infraestructura LATAM, con potencial de denegación de servicio y ejecución de código remoto.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

25/08/2026

Vulnerabilidad alta de inyección SQL en SililaWijesinghe Food Ordering System (CVE-2026-79804)

Se ha identificado una vulnerabilidad de inyección SQL en SililaWijesinghe Food Ordering System que permite manipular el parámetro 'search_box' en el archivo /search.php para ejecutar comandos SQL maliciosos de forma remota. El exploit está públicamente disponible y afecta principalmente a restaurantes y plataformas de delivery en México y Latinoamérica que utilizan este sistema. Con puntuación CVSS 7.3, representa un riesgo alto para la confidencialidad e integridad de bases de datos de clientes y transacciones.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/08/2026

Inyección SQL alta en Simple Inventory System 1.0 permite ejecución remota

Se identificó una vulnerabilidad de inyección SQL en Simple Inventory System 1.0 que afecta el archivo /InventoryManagement/edit.php mediante manipulación del parámetro ID. La vulnerabilidad permite a atacantes remotos ejecutar comandos SQL arbitrarios contra la base de datos del sistema, comprometiendo la integridad y confidencialidad de datos inventariales. Existe exploit público disponible, representando riesgo inminente para empresas en LATAM que utilicen este software en producción.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-65183] Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix …

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat when creating unix domain sockets allows an unauthorised local user to access the unix domain socket. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.42 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58, 9.0.121, which fixes t…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79292] Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who…

Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79286] Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a …

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79266] Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leverag…

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79256] Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 all…

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79263] Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to ex…

Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79247] Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote …

Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79240] Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote …

Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79244] Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to exe…

Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79245] Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compro…

Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 7.7 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79230] Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remot…

Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79231] Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execut…

Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79236] Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute ar…

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79224] Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who h…

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79227] Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leverag…

Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

nvdaltovulnerabilidad CVSS 8.8 NVD