Alertas de Seguridad de la Información

M Alto vulnerabilidad

06/08/2026

[CVE-2026-5857] Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_receive…

Contiki-NG's MQTT client parse_publish_vhdr() in os/net/app-layer/mqtt/mqtt.c sets topic_len_received=1 before checking topic_len against the 64-byte limit, so an over-length topic returns early but leaves the flag set. On the next TCP segment, tcp_input() re-invokes the parser with topic_received==0, and the persisted topic_len_received==1 skips the length-reading block containing the guard, fall…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-43629] llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache st…

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buff…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-19162] Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to exec…

Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en nanoMODBUS v1.23.0: desbordamiento de búfer en lectura de identificación

nanoMODBUS versiones anteriores a v1.24.0 contiene una escritura fuera de límites en la función recv_read_device_identification_res() (FC 0x2B/MEI 0x0E) que permite a servidores Modbus remotos sobrescribir memoria del cliente. Esta vulnerabilidad afecta sistemas de automatización industrial, SCADA y dispositivos IoT en plantas manufactureras, utilities y infraestructura alta en LATAM. Un atacante en la red puede ejecutar código arbitrario o causar denial of service explotando validaciones insuficientes del campo object_length.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

04/08/2026

[CVE-2026-24253] NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds writ…

NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-10849] The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response…

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the full response has arrived, the code writes response_data[downloaded_size] = '\0' — and whenever …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/08/2026

Vulnerabilidad alta en cliente OCPP 1.6: desbordamiento de buffer en parse_rpc_msg()

Se detectó una falla de seguridad en el procesamiento de marcos WAMP RPC dentro del cliente OCPP 1.6 (subsys/net/lib/ocpp). La función extract_string_field() utiliza strncpy() sin garantizar NUL-terminación, permitiendo lectura de memoria adyacente mediante campos uid y action malformados. Esto afecta sistemas de carga de vehículos eléctricos y controladores IoT en infraestructura de movilidad en Latinoamérica.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

31/07/2026

[CVE-2026-34641] Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code…

Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-18022] Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write d…

Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-18220] An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c…

An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation …

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-58188] Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This…

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

29/07/2026

[CVE-2026-58184] The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations…

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.2 NVD

A Alto vulnerabilidad

29/07/2026

[CVE-2026-58177] The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-f…

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

29/07/2026

[CVE-2026-58154] Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP heade…

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

nvdaltovulnerabilidad CVSS 8.9 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-15057] IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of se…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48392] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48393] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-48394] Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execu…

Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64763] An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in i…

An out-of-bounds write issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

27/07/2026

[CVE-2026-64764] An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS…

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

nvdaltovulnerabilidad CVSS 7.8 NVD