Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada hace 42 min

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1009

Esta semana

RSS

Alta × cwe-287 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-17175] IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensiti…

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement.

M Alto vulnerabilidad

[CVE-2026-17099] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication.

M Alto vulnerabilidad

[CVE-2026-17101] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

M Alto vulnerabilidad

[CVE-2026-73655] Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to…

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.2, addGoogleStrategy() in apps/webapp/app/services/googleAuth.server.ts passes a Google profile email to findOrCreateGoogleUser() in apps/webapp/app/models/user.server.ts without requiring Google's email_verified assertion. When existingEmailUser && !existingUser is true, the flow writes the ne…

M Alto vulnerabilidad

[CVE-2026-16867] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privi…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

M Alto vulnerabilidad

[CVE-2026-17197] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to im…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

M Alto vulnerabilidad

[CVE-2026-11923] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-12359] IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 …

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse proxy.

M Alto vulnerabilidad

[CVE-2026-42018] JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when an…

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.

M Alto vulnerabilidad

Vulnerabilidad alta de autenticación en plugin WordPress Passwordless Login de VentraConnect

El plugin 'Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login' para WordPress (versiones hasta 1.4.3) contiene un fallo de autenticación que permite eludir el acceso mediante verificación insuficiente del correo electrónico devuelto por Spotify. Un atacante podría acceder a cuentas sin credenciales válidas. Afecta directamente a sitios WordPress en México y LATAM que implementen este plugin con autenticación social.

M Alto vulnerabilidad

[CVE-2026-71467] A flaw was found in search-v2-api. The authentication middleware in the affected component unconditi…

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted HTTP POST request to the `/federated` endpoint with the `Upgrade: websocket` header. This allows the attacker to bypass authentication and a…

M Alto vulnerabilidad

[CVE-2026-62827] Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate priv…

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

M Alto vulnerabilidad

[CVE-2026-72922] AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificia…

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/backend/backend/api/features/integrations/router.py webhook_ingress_generic route selected get_webhook_manager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webho…

M Alto vulnerabilidad

[CVE-2026-72746] FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a s…

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required at the current step. Because the rdpRdstls object is calloc-zeroed, its resultCode defaults to 0 (RDSTL…

M Alto vulnerabilidad

[CVE-2026-72533] An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privi…

An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged users to bypass Docker proxy authorization checks via non-canonical URL normalization, defeating all authorization middleware. The proxy endpoint fails to normalize request paths before applying access controls, allowing crafted requests to be interpreted differently by the proxy and the autho…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

Vulnerabilidad alta de autenticación en Task Management System 1.0 de code-projects

Se detectó una vulnerabilidad de autenticación deficiente en el componente Login del archivo /index.php en Task Management System 1.0 de code-projects, permitiendo manipulación del parámetro Password para eludir la autenticación de forma remota. El exploit está públicamente disponible y afecta potencialmente a sistemas de gestión de tareas desplegados en infraestructuras empresariales de LATAM. Con CVSS 7.3, requiere atención inmediata en organizaciones que utilicen esta plataforma.

M Alto vulnerabilidad

[CVE-2026-56793] Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authenticatio…

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

M Alto vulnerabilidad

[CVE-2026-16030] The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature…

The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-based login, allowing unauthenticated attackers who know a registered user's phone number to forge a token and take over that user's account, including administrator accounts.

M Alto vulnerabilidad

[CVE-2026-64665] Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, w…

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by emai…

M Alto vulnerabilidad

[CVE-2026-65400] An authentication issue was addressed with improved state management. This issue is fixed in macOS S…

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

← Anterior 1 … 5 6 7 8 9 … 16 Siguiente →