Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

Buscando: "Ni" — 3240 resultados ✕ Limpiar búsqueda

13,599

Total alertas

3086

Críticas

10241

Altas

8

Ransomware

1805

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-72794] siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf …

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.

M Alto vulnerabilidad

[CVE-2026-13361] IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.

IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.

M Alto vulnerabilidad

[CVE-2026-12004] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request.

M Alto vulnerabilidad

[CVE-2026-12618] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input.

M Alto vulnerabilidad

[CVE-2026-19311] Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an…

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

M Alto vulnerabilidad

[CVE-2026-73327] Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a…

Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be wr…

M Alto vulnerabilidad

[CVE-2026-44741] Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18…

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.1…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-17248] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of servic…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

M Alto vulnerabilidad

[CVE-2026-17271] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of input size.

M Alto vulnerabilidad

[CVE-2026-17418] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

M Alto vulnerabilidad

[CVE-2026-16931] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to impro…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.

M Alto vulnerabilidad

[CVE-2026-16627] GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that u…

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

M Alto vulnerabilidad

[CVE-2026-16904] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary comman…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

M Alto vulnerabilidad

[CVE-2026-73292] Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/pas…

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in ve…

M Alto vulnerabilidad

[CVE-2026-73286] RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_cond…

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get_condition_values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowing authenticated callers to satisfy identity-based policy conditions. This issue is fixed in version 1…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-68752] A Project Resource Manager may gain broader administrative privileges under specific conditions.

A Project Resource Manager may gain broader administrative privileges under specific conditions.

M Alto vulnerabilidad

[CVE-2026-57858] Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in …

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to …

M Alto vulnerabilidad

Desbordamiento de búfer alta en Fortinet FortiClient Windows permite ejecución remota de código

Una vulnerabilidad de desbordamiento de búfer en Fortinet FortiClient Windows (versiones 7.2.0-7.2.11 y 7.4.0-7.4.3) permite a atacantes no autenticados ejecutar código arbitrario manipulando respuestas DNS. El ataque requiere posición en la red para alterar tráfico DNS, afectando principalmente a empresas en LATAM con VPN corporativos que confían en FortiClient para acceso remoto seguro.

M Alto vulnerabilidad

Vulnerabilidad alta de ejecución remota de código en repositorio archivado de Cloudflare

Se ha identificado una vulnerabilidad de ejecución remota de código (RCE) en un repositorio archivado de Cloudflare, explotable a través de configuraciones específicas de GitHub Actions. La vulnerabilidad permite comprometer secretos de flujo de trabajo altas como CLOUDFLARE_API_TOKEN y GITHUB_TOKEN, exponiendo credenciales de acceso a infraestructura en la nube. Empresas en LATAM que utilicen este repositorio o mantengan integraciones con GitHub Actions deben verificar inmediatamente su exposición.

M Alto vulnerabilidad

Vulnerabilidad de negación de servicio en PLCnext Engineer (CVE-2025-41770)

Se ha identificado una vulnerabilidad de negación de servicio sin autenticación en la interfaz de comunicación PLCnext Engineer que permite a atacantes remotos interrumpir el acceso a través de la aplicación cliente. La explotación exitosa bloquea la comunicación hasta que el servicio PLCnext se reinicia manualmente, afectando operaciones altas en plantas industriales y sistemas de automatización en LATAM.

← Anterior 1 … 32 33 34 35 36 … 162 Siguiente →