Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1012

Esta semana

RSS

Alta × cwe-908 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-47600] NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer wh…

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate on an improperly initialized resource. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

M Alto vulnerabilidad

[CVE-2026-94056] Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers…

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

M Alto vulnerabilidad

[CVE-2026-54634] Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unau…

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld send_raw command on TCP port 4532 reaches rigctl_send_raw() in tests/rigctl_parse.c, which writes a NUL byte at buf[buf_len + 1] outside its 200-byte stack buffer, and rig_send_raw() in src/rig.c, which copies reply_len - 1 bytes instead of the actual nbytes received. A remote cl…

M Alto vulnerabilidad

[CVE-2026-85880] Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges local…

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

M Alto vulnerabilidad

[CVE-2026-78519] Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute…

Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

M Alto vulnerabilidad

[CVE-2026-72989] Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclos…

Use of uninitialized resource in Windows Failover Cluster allows an unauthorized attacker to disclose information over a network.

M Alto vulnerabilidad

[CVE-2026-69485] Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code…

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-69358] Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code…

Use of uninitialized resource in Remote Desktop Client allows an authorized attacker to execute code over a network.

M Alto vulnerabilidad

[CVE-2026-84326] Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to ex…

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

M Alto vulnerabilidad

[CVE-2026-16868] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the u…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of uninitialized memory during ASN.1 length processing.

L Alto vulnerabilidad

[CVE-2026-66034] libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that …

libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2_publickey_list_fetch(), the version 1 response parser reads a server-controlled comment_len value and advances the parse pointer without…

S Alto vulnerabilidad

[CVE-2026-47247] libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in lib…

libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat AS…

M Alto vulnerabilidad

[CVE-2026-16384] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

M Alto vulnerabilidad

[CVE-2026-16385] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

M Alto vulnerabilidad

[CVE-2026-16386] Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi…

Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-60005] NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the …

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. Impact: This vulnerability m…

M Alto vulnerabilidad

[CVE-2026-55949] Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute c…

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

M Alto vulnerabilidad

[CVE-2026-49165] Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclo…

Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.

L Alto vulnerabilidad

[CVE-2026-53170] In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA comman…

In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: reject DMA commands with uninitialized length cmd_state_init() initializes the command state with memset(0xff), leaving dma->len at U64_MAX to signal missing setup. The only setter is NPU_SET_DMA0_LEN; if userspace omits this command and issues NPU_OP_DMA_START, dma->len remains U64_MAX. In dma_length(), a positiv…

E Alto vulnerabilidad

[CVE-2026-11576] The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to ope…