Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,560

Total alertas

4783

Críticas

17136

Altas

8

Ransomware

1351

Esta semana

RSS

Alta × vulnerabilidad × Limpiar todo ×

W Alto vulnerabilidad

[CVE-2026-7532] iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constrain…

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced in that configuration, allowing a certificate to bypass an issuing CA's IP address constraints.

W Alto vulnerabilidad

[CVE-2026-8720] wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the bloc…

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a MAC that is independent of the input. When the supplied key is longer than the BLAKE2 block size the key-hashing branch reinitialized the running hash state, discarding the accumulated message data, so the resulting MAC depended only on the key and not on the message being authen…

M Alto vulnerabilidad

[CVE-2026-54479] The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows mu…

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers. This vulnerability may allow unauthorized users to authenticate as other users or enable a malicious actor to cause a denial-of-service condition by overwhelming the backend…

W Alto vulnerabilidad

[CVE-2026-6325] Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, …

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write past the bounds of the destination buffer.

G Alto vulnerabilidad

[CVE-2026-13283] Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote atta…

Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

M Alto vulnerabilidad

[CVE-2026-22879] vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

M Alto vulnerabilidad

[CVE-2026-50176] The WebSocket Application Programming Interface lacks restrictions on the number of authentication r…

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

W Alto vulnerabilidad

[CVE-2026-11703] Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding c…

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual hosts, carry the cached peer-authentication state into a context it was not established for. Resumption n…

R Alto vulnerabilidad

[CVE-2026-11800] A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Gr…

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized acces…

R Alto vulnerabilidad

[CVE-2026-12975] A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParse…

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without enabling secure processing features or disabling external entity resolution. An attacker with artifact-write permission (or unauthenticated when the registry runs with default configuration) can upload a crafted XML document to trigger blind server-side request forgery (SSRF) via ex…

R Alto vulnerabilidad

[CVE-2026-12992] A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without di…

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forger…

G Alto vulnerabilidad

[CVE-2026-13281] Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had …

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

F Alto vulnerabilidad

[CVE-2025-71335] Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions an…

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An attacker who already holds an active session, for example via a stolen session token or a device left logged in, remains authenticated as the legitimate user even after the user rotates their credentials, undermining the security purpose of th…

M Alto vulnerabilidad

[CVE-2025-71340] picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.Modifie…

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30.

P Alto vulnerabilidad

[CVE-2021-47986] Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were p…

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2021-47987] Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags w…

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it defined a git-based dependency referencing one of the affected tags (for example, parse-server#4.9.3). The co…

F Alto vulnerabilidad

[CVE-2025-71324] Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /a…

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal bey…

F Alto vulnerabilidad

[CVE-2025-71328] Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user ca…

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account settings (Security) section without supplying the current password or any additional verification, as the application does not enforce a current-password check on the credential change. This can lead to full account takeover, particularly if an att…

W Alto vulnerabilidad

[CVE-2026-6679] A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer…

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. The buffer overflow was due to an integer truncation when computing the length of the ACK record-number list, causing an undersized buffer to be allocated and then overrun. This affects builds using DTLS 1.3 and wolfSSL version 5.9.0 and earlier. A fix was added to the 5.9.1 relea…

W Alto vulnerabilidad

[CVE-2026-6731] X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certific…

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN violates an issuing CA's DNS name constraints could be accepted.

← Anterior 1 … 710 711 712 713 714 … 846 Siguiente →