Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,560

Total alertas

4783

Críticas

17136

Altas

8

Ransomware

1355

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-46608] Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC…

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC server (glances -s) introduced a configurable CORS origin list in version 4.5.3 as a mitigation for CVE-2026-33533. However, the implementation silently falls back to Access-Control-Allow-Origin: * whenever cors_origins contains more than one entry. An operator who configures an explicit two-entry …

A Alto vulnerabilidad

[CVE-2026-12921] In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by a…

In AzeoTech DAQFactory versions 21.1 and prior, a Use After Free vulnerability can be exploited by an attacker using specially crafted .ctl files which can result in code execution.

P Alto vulnerabilidad

[CVE-2026-55700] pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename …

pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. This vulnerability is fi…

W Alto vulnerabilidad

[CVE-2026-55961] wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains n…

wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signerInfos, so the underlying signed-data verification succeeds without authenticating any content. The compatibility-layer verify path now rejects the object when no signer signature has actually been verified, so a PKCS#7 carrying no valid signature is no longer…

W Alto vulnerabilidad

[CVE-2026-55967] AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were no…

AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.

P Alto vulnerabilidad

[CVE-2026-55487] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stri…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

P Alto vulnerabilidad

[CVE-2026-55697] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency as an install-engine opt-in. During install, pnpm resolved a platform-specific @pacquet/-

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

P Alto vulnerabilidad

[CVE-2026-55698] pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap m…

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can persist package-manager bootstrap metadata in the first YAML document of pnpm-lock.yaml. Before the patch, direct pnpm execution trusted an already resolved packageManagerDependencies entry when the committed env lockfile contained matching pnpm and @pnpm/exe versions. A malicious repository could therefore commit package-manager loc…

P Alto vulnerabilidad

[CVE-2026-50015] pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/pat…

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff…

P Alto vulnerabilidad

[CVE-2026-50016] pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias fr…

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-…

P Alto vulnerabilidad

[CVE-2026-48995] pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can s…

pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. The lockfile does not store the hash of the dependencies from https://codeload.github.com. This means that if this server was compromised or a person's machine configuration was compromised, pnpm would download and i…

J Alto vulnerabilidad

[CVE-2026-49839] jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-str…

jq is a command-line JSON processor. Prior to 1.8.2,` jq --rawfile` can turn a handled oversized-string error into invalid-state reuse and a real heap out-of-bounds write in assertion-disabled builds. When jv_load_file(raw=1) reads an attacker-controlled file, it repeatedly appends file chunks to the same jv string accumulator. Once jv_string_append_buf() returns jv_invalid_with_msg("String too lo…

W Alto vulnerabilidad

[CVE-2026-11999] X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (…

X.509 trust-chain bypass (path-depth exhaustion) in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects only builds with --enable-opensslextra whose application calls X509_verify_cert() with caller-supplied untrusted intermediates; for those users it is critical, otherwise the library is unaffected. Native wolfSSL TLS/DTLS usage is not impacted. X509_verify_ce…

R Alto vulnerabilidad

[CVE-2026-9800] A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to by…

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a request URL, either as a path segment or a query parameter, an attacker can gain unauthorized access to protected resources.

R Alto vulnerabilidad

[CVE-2026-9086] A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those w…

A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registering a malicious client with a specially crafted redirect URI using a case-insensitive `javascript:` or `data:` scheme. This Cross-S…

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

R Alto vulnerabilidad

[CVE-2026-9099] A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint…

A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing group. When Fine-Grained Admin Permissions v2 (FGAPv2) is enabled, an attacker with management rights over a single low-privilege group can reparent a highly privileged group (such…

D Alto vulnerabilidad

[CVE-2026-56123] socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allow…

socat versions 1.8.0.0 through 1.8.1.1 contain a heap-based buffer overflow vulnerability that allows a malicious SOCKS5 proxy server to overwrite adjacent heap memory by exploiting a sign-extension flaw in the DOMAINNAME reply parser. During connection setup, the domain name length byte is read through a signed char field causing a negative bytes_to_read value that is implicitly converted to size…

M Alto vulnerabilidad

[CVE-2026-55412] ToolJet is the open-source foundation am AI-native platform for building and deploying internal tool…

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.178-lts, there's an SSRF in the RestAPI data source component. The RestAPI data source executes HTTP requests server-side, and its private IP filter only checks the hostname string — not the resolved IP. DNS names like 169.254.169.254.nip.io resolve to the A…

A Alto vulnerabilidad

[CVE-2026-55092] Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.…

Trivy is a security scanner. Prior to 0.71.1, when Trivy downloads an OCI artifact, it uses the org.opencontainers.image.title annotation from the artifact manifest as the destination filename without validation. An attacker who can make Trivy fetch an attacker-controlled artifact can supply a crafted annotation that resolves to a path outside the intended destination, causing Trivy to write the l…

L Alto vulnerabilidad

[CVE-2026-54030] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreCha…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata (RFC 9728) matches the configured MCP server URL, allowing a malicious MCP server to steal access tokens intended for a legitimate server. This vulnerability is fixed in 0.8.5.

← Anterior 1 … 718 719 720 721 722 … 857 Siguiente →