Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,949

Total alertas

3186

Críticas

10491

Altas

8

Ransomware

1233

Esta semana

RSS

Alta × alto × Limpiar todo ×

G Alto vulnerabilidad

[CVE-2026-13283] Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote atta…

Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

M Alto vulnerabilidad

[CVE-2026-22879] vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

M Alto vulnerabilidad

[CVE-2026-50176] The WebSocket Application Programming Interface lacks restrictions on the number of authentication r…

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

W Alto vulnerabilidad

[CVE-2026-11703] Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding c…

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption n…

R Alto vulnerabilidad

[CVE-2026-11800] A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr…

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized acces…

R Alto vulnerabilidad

[CVE-2026-12975] A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParse…

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via ex…

R Alto vulnerabilidad

[CVE-2026-12992] A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without di…

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forger…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

G Alto vulnerabilidad

[CVE-2026-13281] Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had …

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

F Alto vulnerabilidad

[CVE-2025-71335] Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions an…

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of th…

M Alto vulnerabilidad

[CVE-2025-71340] picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.Modifie…

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

P Alto vulnerabilidad

[CVE-2021-47986] Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were p…

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

M Alto vulnerabilidad

[CVE-2021-47987] Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags w…

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it defined a git-based dependency referencing one of the affected tags (for example, parse-server#4.9.3). The co…

F Alto vulnerabilidad

[CVE-2025-71324] Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /a…

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal bey…

F Alto vulnerabilidad

[CVE-2025-71328] Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user ca…

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an att…

W Alto vulnerabilidad

[CVE-2026-6679] A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer…

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 relea…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

W Alto vulnerabilidad

[CVE-2026-6731] X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certific…

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.

M Alto vulnerabilidad

[CVE-2026-38640] A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows att…

A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted string.

M Alto vulnerabilidad

[CVE-2026-12473] Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitra…

Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.

M Alto vulnerabilidad

[CVE-2026-37452] Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attac…

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSIAPService.exe component

M Alto vulnerabilidad

[CVE-2026-38637] An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to…

An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.

← Anterior 1 … 379 380 381 382 383 … 510 Siguiente →