Alertas de Seguridad de la Información

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85109] A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of…

A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the component Boa Web Server. Executing a manipulation of the argument Username can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85154] WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a…

WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer token that grants full administrator session access to the video owner's account. Attackers who obtain a video_id_hash can replay it indefinitely to authenticate as the video owner with full privileges, and the credential remains valid even after the owner changes…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-85031] A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of th…

A vulnerability was found in TOTOLINK CP450 4.1.0. The impacted element is an unknown function of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument topicurl results in buffer overflow. Remote exploitation of the attack is possible.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

03/09/2026

[CVE-2026-80726] In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear ro…

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page Explicitly clear role.invalid when deriving a child shadow page's role from its parent to harden against bugs elsewhere in KVM, as violating KVM's invariant that invalid pages are NOT on the list of active MMU pages leads to use-after-free due to __kvm_m…

nvdcriticovulnerabilidad CVSS 9.3 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en autenticación FIDO2 permite suplantación de identidad en despliegues locales

Una vulnerabilidad de puntuación CVSS 9.8 en sistemas FIDO2 permite a atacantes registrar credenciales maliciosas contra cuentas objetivo y autenticarse como el usuario legítimo. El riesgo afecta únicamente despliegues on-premises. Empresas en LATAM que implementen autenticación FIDO2 en infraestructura interna deben evaluar inmediatamente su exposición, especialmente en sectores financiero, gubernamental y de telecomunicaciones.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Submariner: inyección de configuración en modo cert-auth

Se identificó una falla en Submariner que permite inyección de configuración arbitraria en modo autenticación por certificados. Un cluster malicioso puede explotar esta vulnerabilidad publicando un CableName con saltos de línea y directivas de ipsec.conf sin validación previa, comprometiendo la seguridad de redes híbridas y multi-cluster. El impacto afecta directamente a empresas en LATAM con infraestructuras Kubernetes distribuidas en cloud público y privado.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Joro framework: exposición de API local sin autenticación

Joro, un framework de pruebas web, presenta una vulnerabilidad crítica (CVSS 9.6) en versiones anteriores a 1.1.1 que expone una API local sin autenticación en 127.0.0.1:9090 con política CORS permisiva. Un atacante puede ejecutar JavaScript malicioso desde cualquier sitio visitado para cargar plugins nativos y comprometer completamente el sistema. Esta exposición afecta principalmente a equipos de seguridad y desarrolladores que utilizan Joro para análisis de aplicaciones web en infraestructuras empresariales de LATAM.

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20279] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20279 are related to improper access control issues that are g…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20274] As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR So…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-20212] A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an u…

A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the default Layer 3 (L3) virtual routing and forwarding (VRF). A successful exploit could allow the attacker to connect to an affected device an…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-53611] Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary…

Looking Glass is a modern, stateless network-diagnostic platform — a single self-contained Go binary that fronts a fleet of routers over SSH and exposes ping / traceroute / BGP lookups through a gRPC (ConnectRPC) API, an embedded SvelteKit web UI, and a lg-cli client. Prior to version 1.3.5, there is an OS Command Injection vulnerability resulting from an unanchored regular expression in the input…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-77009] The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console,…

The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica de XSS almacenado en SiYuan anterior a v3.8.2 permite robo de tokens API

SiYuan versiones anteriores a v3.8.2 contiene una vulnerabilidad de cross-site scripting (XSS) almacenado en el servidor de activos debido a una lista de bloqueo de extensiones incompleta. Atacantes pueden cargar archivos con extensiones como .xht, .ehtml, .xsl, .xbl o .rdf que se resuelven como tipos de medios ejecutables, permitiendo ejecutar JavaScript para robar tokens API y comprometer espacios de trabajo. El CVSS de 9.0 indica severidad crítica con alto impacto en confidencialidad e integridad.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

02/09/2026

Vulnerabilidad crítica en Craft CMS anterior a 5.10.11 permite escalación de privilegios

Craft CMS versiones anteriores a 5.10.11 no valida correctamente la bandera de administrador durante el registro de usuarios, permitiendo que atacantes hereden permisos administrativos registrándose con direcciones de correo de cuentas administrador desactivadas. Esta vulnerabilidad afecta especialmente a instancias con registro público habilitado y verificación de correo desactivada, exponiendo sistemas de gestión de contenidos en empresas mexicanas y latinoamericanas.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-78657] The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletio…

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84352] Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attac…

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84353] Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a …

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84354] Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attac…

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84333] Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attack…

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.6 NVD

M Crítico vulnerabilidad

02/09/2026

[CVE-2026-84324] Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute…

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)

nvdcriticovulnerabilidad CVSS 9.0 NVD