Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada hace 1 hora

Buscando: "Quest" — 1671 resultados ✕ Limpiar búsqueda

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1003

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-36611] Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer w…

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 returns 128 bytes of uninitialized buffer when receiving POST requests without SOAPAction header on UPnP port 1900, exposing internal memory to unauthenticated adjacent network attackers.

M Alto vulnerabilidad

[CVE-2026-36608] Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forwar…

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own IP (192.168.1.1) or localhost (127.0.0.1) as InternalClient. An unauthenticated LAN attacker can expose the admin panel to the internet with a single SOAP request.

L Alto vulnerabilidad

[CVE-2026-31942] LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and in…

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to the use of the JavaScript object spread operator after setting the authenticated user's ID, any authenticated user can inject a userId parameter in the request b…

M Alto vulnerabilidad

[CVE-2026-49143] BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP h…

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Fun…

M Alto vulnerabilidad

[CVE-2026-49120] Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worke…

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints at internal addresses such as cloud instance metadata services, internal databases, or container orches…

A Alto vulnerabilidad

[CVE-2026-47265] AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.1…

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If…

S Alto vulnerabilidad

[CVE-2026-42211] React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a c…

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps could potentially allow unauthorized remote code execution (RCE) through external requests. This attack requires the application code to have an existing prototype pollution vulnerability, which can then be leveraged in a 2-step attack where the second step triggers unauthorized …

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

S Alto vulnerabilidad

[CVE-2026-42342] React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.…

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4 of @remix-run/server-runtime, certain crafted requests can consume disproportionate server resources via unbounded path expansion in the __manifest endpoint, resulting in response time degradation and/or service unavailability for end users. This affects React Router Framework Mo…

L Alto vulnerabilidad KEV

CVE-2025-34291: Vulnerabilidad crítica en Langflow bajo explotación activa

CISA confirmó explotación activa de una vulnerabilidad en Langflow, plataforma de orquestación de flujos de IA utilizada en empresas mexicanas y latinoamericanas. No se han reportado asociaciones con campañas de ransomware conocidas hasta el momento. La vulnerabilidad afecta directamente a organizaciones que ejecutan Langflow en entornos cloud o on-premise para procesos de automatización basados en modelos de lenguaje.

Q Alto vulnerabilidad KEV

Vulnerabilidad crítica en Quest KACE SMA bajo explotación activa

CISA ha confirmado explotación activa de CVE-2025-32975 en Quest KACE Systems Management Appliance (SMA), plataforma de gestión de TI ampliamente desplegada en infraestructuras corporativas latinoamericanas. Aunque no se ha vinculado a campañas de ransomware conocidas, el estado de explotación activa requiere acción inmediata. La remediación debe completarse antes del 4 de mayo de 2026 conforme a la directiva CISA BOD 22-01.

L Alto vulnerabilidad

Vulnerabilidad crítica en Langflow confirmada en explotación activa (CVE-2026-33017)

CISA ha confirmado la explotación activa de una vulnerabilidad en Langflow sin asociación con campañas de ransomware conocidas hasta el momento. La vulnerabilidad afecta a plataformas de automatización de flujos de trabajo utilizadas en empresas LATAM para integración de APIs y orquestación de procesos. El plazo de remediación obligatorio según directiva CISA BOD 22-01 vence el 8 de abril de 2026.

← Anterior 1 … 82 83 84