Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada hace 36 min

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1009

Esta semana

RSS

Crítica × cwe-321 × Limpiar todo ×

M Crítico vulnerabilidad

[CVE-2026-82827] Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Ke…

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of JWT signing secret key allows an attacker to generate unauthorized Bearer tokens and exploit administrative functions. This issue affects Hitachi Coding Software Suite: through 3.3.0.

M Crítico vulnerabilidad

[CVE-2026-86708] ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of …

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

M Crítico vulnerabilidad

[CVE-2026-81855] A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framew…

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard.

M Crítico vulnerabilidad

[CVE-2026-78225] A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller compo…

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.

M Crítico vulnerabilidad

[CVE-2026-89026] The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf cont…

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, c…

M Crítico vulnerabilidad

[CVE-2026-90945] Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be over…

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes.

M Crítico vulnerabilidad

[CVE-2026-87929] MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config…

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

[CVE-2026-53939] OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In ve…

OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm (`A128CBC-HS256`, `A192CBC-HS384`, or `A256CBC-HS512`) together with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being…

M Crítico vulnerabilidad

[CVE-2026-74233] Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19…

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated att…

M Crítico vulnerabilidad

Vulnerabilidad crítica en HUMANIST Digital Human Resources por clave criptográfica codificada

Se detectó una vulnerabilidad de severidad alta (CVSS 9.1) en HUMANIST Digital Human Resources versiones 26.0 anteriores a 26.1, que permite a atacantes leer constantes sensibles dentro del ejecutable mediante claves criptográficas hardcodeadas. Esto expone credenciales y datos confidenciales de recursos humanos en empresas de México y LATAM. La vulnerabilidad afecta principalmente a organizaciones que usan este sistema para gestión de nómina y personal.

M Crítico vulnerabilidad

Clave RSA estática incrustada en firmware afecta servidores Lighttpd (CVE-2026-18753)

Firmware de múltiples fabricantes contiene una clave privada RSA estática utilizada por el servidor web Lighttpd para terminación TLS. Su exposición permite a atacantes descifrar tráfico HTTPS, suplantar servidores y comprometer la confidencialidad e integridad de comunicaciones. Afecta especialmente infraestructuras de borde y dispositivos IoT en datacenters LATAM.

M Crítico vulnerabilidad

Clave RSA privada incrustada en firmware afecta servidores Lighttpd (CVE-2026-18754)

El firmware de múltiples dispositivos contiene una clave RSA privada estática utilizada por el servidor web Lighttpd para terminación TLS. La exposición de esta clave permite a atacantes descifrar comunicaciones HTTPS, suplantar servidores y comprometer la confidencialidad e integridad de datos sensibles en tránsito. Impacta infraestructuras críticas y plataformas de comercio electrónico en LATAM que dependen de este servicio web.

M Crítico vulnerabilidad

[CVE-2026-54363] CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthentic…

CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt() and AccessTicket.Decrypt() across all installations. Attackers can use the hardcoded key to craft valid x-glad-auth headers and call privileged API endpoints such as a…

M Crítico vulnerabilidad

[CVE-2021-32086] An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcod…

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain pri…

M Crítico vulnerabilidad

[CVE-2026-47410] PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior …

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal `"dev-secret-change-me"` when `PLATFORM_JWT_SECRET` is unset. A safety check exists but only fires when `PLATFORM_ENV != "dev"`; the default value of `PLATFORM_ENV` is `"dev"`, so the check …

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Crítico vulnerabilidad

[CVE-2026-62241] clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-de…

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan records containing userId values without authentication, a remote unauthenticated attacker can harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known …

F Crítico vulnerabilidad

[CVE-2026-56271] Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets …

Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and issuer values ('AUDIENCE', 'ISSUER') in the enterprise passport authentication middleware (packages/server/src/enterprise/middleware/passport/index.ts). When the corresponding environment variables (JWT_AUTH_TOKEN_SECRET, JWT_REFRESH_TOKEN_SEC…

M Crítico vulnerabilidad

[CVE-2026-28742] Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embed…

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmware image. Once this salt is recovered from any device, an attacker can generate valid signatures for arbitrary device or account operations due to the absence of per-device keys, server-side nonce tracking, or replay protections. Combined with the system’s use of plain HTTP for co…

A Crítico vulnerabilidad

[CVE-2026-50091] Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same libl…

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).