Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,509

Total alertas

3066

Críticas

10171

Altas

8

Ransomware

1785

Esta semana

RSS

Alta × cwe-269 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-73305] Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign cal…

Budibase is an open-source low-code platform. Prior to 3.39.24, POST /api/public/v1/roles/assign called validateGlobalRoleUpdate without checking appBuilder.appId or role.appId in packages/server/src/api/controllers/public/globalRoleValidation.ts. An app-scoped builder could scope the request to an app they control and then grant themselves builder access or an arbitrary role in another app, expos…

M Alto vulnerabilidad

[CVE-2026-18101] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to imprope…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.

M Alto vulnerabilidad

[CVE-2026-18193] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.

M Alto vulnerabilidad

[CVE-2026-18249] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.

M Alto vulnerabilidad

[CVE-2026-16722] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized priv…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

M Alto vulnerabilidad

[CVE-2026-18071] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to imprope…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.

M Alto vulnerabilidad

[CVE-2026-17082] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-18713] IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authentica…

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

M Alto vulnerabilidad

[CVE-2026-16904] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

M Alto vulnerabilidad

[CVE-2026-73293] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 …

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner cap…

M Alto vulnerabilidad

[CVE-2026-73284] RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/…

RustFS is a distributed object storage system built in Rust. RustFS AddServiceAccount in rustfs/src/admin/handlers/service_account.rs accepts an attacker-controlled target_user after only checking CreateServiceAccountAdminAction, passes it to new_service_account, and prepare_service_account_auth sets is_owner for the resulting root-parent service account. This issue is fixed in version 1.0.0-beta.…

M Alto vulnerabilidad

[CVE-2026-68752] A Project Resource Manager may gain broader administrative privileges under specific conditions.

A Project Resource Manager may gain broader administrative privileges under specific conditions.

M Alto vulnerabilidad

Vulnerabilidad alta en Red Hat Advanced Cluster Management permite acceso no autorizado a secretos

Una flaw en el componente multicloud-operators-channel de Red Hat Advanced Cluster Management (RHACM) permite que agentes comprometidos de clústeres gestionados accedan sin autorización a Secrets y ConfigMaps en namespaces de Channel, exponiendo credenciales de Git, Helm y otros servicios de múltiples tenants. El impacto es alta en entornos multicloud híbridos comunes en empresas de LATAM que utilizan RHACM para orquestar infraestructura en AWS, Azure y plataformas on-premise.

M Alto vulnerabilidad

[CVE-2026-15426] The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugi…

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwri…

M Alto vulnerabilidad

[CVE-2026-68821] Improper privilege management in Windows Package Manager allows an authorized attacker to elevate pr…

Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-72534] A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an atta…

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to gain superuser privileges by provisioning a SCIM group that matches an existing administrator group by name. The SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against t…

M Alto vulnerabilidad

[CVE-2026-72537] A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an atta…

A privilege escalation vulnerability in Authentik Security authentik through 2026.5.6 allows an attacker with a source-scoped SCIM provisioning token to take over any user account including superusers by provisioning a SCIM user that matches an existing local user by username. The SCIM user ingest function adopts pre-existing local accounts by username without validating scope boundaries. An attac…

M Alto vulnerabilidad

[CVE-2026-19381] A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacte…

A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component Driver. Performing a manipulation results in improper privilege management. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The vendor was contacted e…

M Alto vulnerabilidad

[CVE-2026-15215] The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capabilit…

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manager role (who lack Subscriptions for WooCommerce WordPress plugin before 2.0.1-management capabilities) t…

M Alto vulnerabilidad

Vulnerabilidad de escalada de privilegios en PowerISO 9.3.0.0 (CVE-2026-19189)

Se ha descubierto una flaw de seguridad en PowerISO versión 9.3.0.0 que afecta el controlador de kernel scdemu.sys, permitiendo escalada impropia de privilegios. El exploit está público y requiere acceso local a la máquina. Empresas en LATAM que usen esta herramienta para virtualización o gestión de imágenes ISO deben evaluar el riesgo inmediato en estaciones de trabajo y servidores, especialmente en entornos donde usuarios estándar comparten equipos.

← Anterior 1 2 3 4 5 … 15 Siguiente →