Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,394

Total alertas

3047

Críticas

10075

Altas

8

Ransomware

1739

Esta semana

RSS

Alta × cwe-95 × Limpiar todo ×

M Alto vulnerabilidad

Vulnerabilidad de inyección de código en CHIRP permite ejecución remota vía archivos CSV malformados

CHIRP (chirpmyradio) versiones anteriores a 39178db contiene una vulnerabilidad de inyección eval en el controlador Kenwood ITM que permite a atacantes ejecutar código arbitrario mediante archivos CSV especialmente diseñados. Esto afecta a operadores de radiocomunicaciones y empresas que utilizan esta herramienta para configuración de equipos en México y Latinoamérica.

M Alto vulnerabilidad

[CVE-2026-76833] @cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to…

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environm…

M Alto vulnerabilidad

[CVE-2026-34398] FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mo…

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval(), allowing arbitrary Python code execution when a user loads a malicious BIM project template. This issue …

M Alto vulnerabilidad

[CVE-2026-34399] FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCA…

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1.

M Alto vulnerabilidad

[CVE-2026-74234] Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achi…

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram…

M Alto vulnerabilidad

[CVE-2026-73231] Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.…

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to access the Function constructor through fakeEval.resolveProperty when a function returns another function, enabling arbitrary JavaScript code execution. This issue is fixed in version 10.5.0.

M Alto vulnerabilidad

[CVE-2026-67195] Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attacke…

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval() with only __builtins__={} cleared. Attackers can exploit Python object attribute traversal through the interpr…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Alto vulnerabilidad

[CVE-2026-55415] datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr…

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.11.6 until 0.64.0, datamodel-code-generator allows attacker-controlled x-python-import or customTypePath schema extensions to reach src/datamodel_code_generator/parser/jsonschema.py and generated import handling thr…

M Alto vulnerabilidad

[CVE-2026-45293] WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding …

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously craf…

M Alto vulnerabilidad

[CVE-2025-71408] NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the…

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or san…

P Alto vulnerabilidad

[CVE-2026-14380] DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. …

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code e…

M Alto vulnerabilidad

[CVE-2025-71361] picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle…

picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

V Alto vulnerabilidad

[CVE-2026-52858] Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completi…

Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim with the +python3 interpreter enabled (and the legacy pythoncomplete.vim for builds with the +python interpreter) executes the import and from statements found in the current buffer through Python's import machinery. Because the buffer's working directory is …

M Alto vulnerabilidad

[CVE-2026-11422] Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability…

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom rendering pipeline that allows attackers to execute arbitrary JavaScript by embedding malicious content in a wavedrom fenced code block within a crafted Markdown document. Attackers can exploit the unsanitized passing of wavedrom block content to window.eval() in the VS Code webview…

M Alto vulnerabilidad

[CVE-2026-50733] Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown co…

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), allowing arbitrary JavaScript execution. The flaw affects every render path - the live preview (window.eval) and presentation mode plus HTML export (the bundled WaveDrom.ProcessAll()/eva() helpers) - and can also be triggered through a element injected via…