Alertas de Seguridad de la Información

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100811] Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed…

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100800] Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was…

Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4 and Firefox 157.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100804] Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was f…

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100786] Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Fire…

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100778] Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed…

Sandbox escape due to use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100770] Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was…

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-100762] Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was…

Sandbox escape due to use-after-free in the DOM: Content Processes component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de autenticación en Hitachi Energy RTU500 permite carga de firmware no autorizada

Se ha identificado una vulnerabilidad de omisión de autenticación (CVE-2026-8065, CVSS 9.1) en el endpoint de actualización de firmware de Hitachi Energy RTU500 que permite a atacantes no autenticados cargar firmware malicioso mediante solicitudes POST modificadas. La explotación exitosa podría comprometer la funcionalidad operativa, integridad y disponibilidad del dispositivo, afectando principalmente infraestructuras críticas de energía, agua y telecomunicaciones en LATAM que dependen de estos controladores RTU.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de traversal de directorios en Hitachi Energy RTU500 permite escritura de archivos arbitrarios

Una vulnerabilidad de traversal de directorios en la funcionalidad de carga de archivos del Hitachi Energy RTU500 permite a atacantes no autenticados escribir o sobrescribir archivos arbitrarios en el sistema de ficheros del dispositivo. La explotación exitosa podría resultar en modificación no autorizada de datos críticos de control o interrupción de operaciones en plantas de generación, subestaciones y sistemas de distribución de energía comúnmente desplegados en infraestructura LATAM.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

Vulnerabilidad crítica de inyección de código en GEOVIA Geospatial Data Manager (CVSS 9.9)

Una vulnerabilidad de inyección de código afecta GEOVIA Geospatial Data Manager en las versiones 3DEXPERIENCE R2024x hasta R2026x, permitiendo a atacantes ejecutar código arbitrario en el servidor. Empresas en México y LATAM que utilizan esta plataforma para gestión de datos geoespaciales enfrentan riesgo crítico de compromiso total de infraestructura si no aplican parches inmediatamente.

nvdcriticovulnerabilidad CVSS 9.9 NVD

? Crítico alerta

29/09/2026

CISA Adds One Known Exploited Vulnerability to Catalog

CISA emite alerta de seguridad: CISA Adds One Known Exploited Vulnerability to Catalog. CVEs relacionados: CVE-2026-86950.

cisaus-certalerta CISA KEV

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-102240] A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the…

A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not res…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101354] A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the fun…

A security flaw has been discovered in FAST FAC1203R 20200116_2.0.4. The affected element is the function _tWlanTask of the component MmtAtePrase Parser. Performing a manipulation results in stack-based buffer overflow. The attacker must have access to the local network to execute the attack. The exploit has been released to the public and may be used for attacks. The vendor was contacted early ab…

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101264] A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the…

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

29/09/2026

[CVE-2026-101263] A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing …

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101261] A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/Z…

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101262] A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown cod…

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any wa…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101260] A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown f…

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respon…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-102268] PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/…

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result, HMACAlgorithm.prepare_key treats the u…

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

28/09/2026

[CVE-2026-101187] A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the functio…

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used f…

nvdcriticovulnerabilidad CVSS 9.1 NVD