Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,509

Total alertas

3066

Críticas

10171

Altas

8

Ransomware

1810

Esta semana

RSS

Alta × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-62316] Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior t…

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to localhost:8010 but does not validate the Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas through …

M Alto vulnerabilidad

[CVE-2026-63135] YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS …

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourls_log_redirect(), then aggregates the value in yourls-infos.php and passes the derived domain through yourls_get_domain(), yourls_stats_pie(), and yourls_google_array_to_data_table(). The chart builder…

M Alto vulnerabilidad

[CVE-2026-63421] Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packag…

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return mo…

M Alto vulnerabilidad

[CVE-2026-64679] Atlantis is a self-hosted golang application that listens for Terraform pull request events via webh…

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended …

M Alto vulnerabilidad

[CVE-2026-54457] TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation,…

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/object_storage endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gat…

M Alto vulnerabilidad

[CVE-2026-50538] LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15…

LibVNCClient is a library for easy implementation of a VNC client. In versions 0.9.12 through 0.9.15, a malicious (or man-in-the-middle) VNC server can force a connecting `libvncclient` to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It needs no authentication (the attacker is the server),…

M Alto vulnerabilidad

[CVE-2026-30890] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-31803] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected …

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-31880] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-30826] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-30865] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-62960] Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server…

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare U…

M Alto vulnerabilidad

[CVE-2026-27490] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are acces…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, inline images that are accessible without being authenticated are protected by a weak 24-bit pseudo-random secret. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-30819] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-S…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop has a reflected Cross-Site Scripting (XSS) vulnerability in its dashboard revert functionality with the parameter dashboard_id in /pages/ajax.render.php. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-30866] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can ac…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, unauthenticated users can access uploaded sensitive via sniffed url. This issue has been fixed in version 3.2.3.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-27462] Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different respo…

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, iTop returns different responses for valid/invalid usernames depending on multiple factors in the reset password mechanism, leading to user enumeration. This issue has been fixed in version 3.2.3.

M Alto vulnerabilidad

[CVE-2026-63462] Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared …

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOpenApiValidationErrors without guarding stack exhaustion. An unauthenticated attacker can send a roughly 10 KB JSON value nested thousands of …

M Alto vulnerabilidad

[CVE-2026-54682] DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with …

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, HTML exports generated with markdown formatting disabled pass attacker-controlled content through FormatMarkdownAsync and FormatEmbedMarkdownAsync in DiscordChatExporter.Core/Exporting/MessageGroupTemplate.cshtml and render it without HTML entity encoding. The affected fields include message.Content, message.ForwardedMessage.C…

M Alto vulnerabilidad

[CVE-2026-54071] BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/…

BabelDOC is a document translation tool. Prior to 0.6.3, BabelDOC's vendored PDF parser in babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when CMapDB._load_data() loads CMap files. PDF-controlled Encoding or CMapName values and embedded PostScript usecmap operators can reach this sink after path separators are decoded, while _normalize_cmap_name() removes only a leading slash. Abso…

M Alto vulnerabilidad

[CVE-2026-77234] Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-e…

Improper input validation in FreeRTOS-Kernel before 11.3.1 might allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context. To remediate this issue, users should upgrade to version 11.3.1 or later.

← Anterior 1 … 7 8 9 10 11 … 509 Siguiente →