Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

22,093

Total alertas

4671

Críticas

16834

Altas

8

Ransomware

1012

Esta semana

RSS

Crítica × cwe-787 × Limpiar todo ×

M Crítico vulnerabilidad Nuevo

[CVE-2026-107909] A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_…

A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly corrupt heap memory by sending a WebSocket frame with a 64-bit extended payload length to the Bolt port. The payload length is not bounded, and the only boun…

M Crítico vulnerabilidad Nuevo

[CVE-2026-107908] A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB b…

A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt port. The handler checks the size only with ASSERT(), which is compiled out in release builds, then co…

M Crítico vulnerabilidad

[CVE-2026-14992] IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,…

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 vulnerable to buffer overflow.

M Crítico vulnerabilidad

[CVE-2026-14991] IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,…

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

M Crítico vulnerabilidad

[CVE-2026-15762] IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,…

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

M Crítico vulnerabilidad

[CVE-2026-16340] IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10,…

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write in the RFC2047 encoded-word parser.

M Crítico vulnerabilidad

[CVE-2026-106401] Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to po…

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

[CVE-2026-77178] Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host …

Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp in the PCNet (Am79C970A) network device model.

M Crítico vulnerabilidad

[CVE-2026-103628] Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to ex…

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

M Crítico vulnerabilidad

[CVE-2026-103110] Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that …

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code remotely as an unprivileged user on a Pexip Infinity Conferencing Node.

M Crítico vulnerabilidad

[CVE-2026-95357] Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote at…

Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

M Crítico vulnerabilidad

[CVE-2026-95329] Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote …

Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

M Crítico vulnerabilidad

[CVE-2026-95331] Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to po…

Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

M Crítico vulnerabilidad

[CVE-2026-100740] A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_param…

A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may be used.

M Crítico vulnerabilidad

Vulnerabilidad crítica en D-Link DIR-825 permite escritura fuera de límites

Se identificó una vulnerabilidad de severidad crítica (CVSS 9.8) en el enrutador D-Link DIR-825 versión 3.00b32, específicamente en la función tunnel_set_params del componente rp-l2tp. Un atacante remoto puede explotar el parámetro peer_hostname para ejecutar escritura fuera de límites de memoria, comprometiendo la integridad del dispositivo. Esta vulnerabilidad afecta principalmente infraestructuras de pequeñas y medianas empresas en LATAM que utilizan este modelo como gateway de acceso.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Crítico vulnerabilidad

[CVE-2026-87121] lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain …

lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.

M Crítico vulnerabilidad

[CVE-2026-84383] libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF…

libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with different bit depths to m_storage. HeifPixelImage::scale_nearest_neighbor() in libheif/image/pixelimage.cc allocates the destination Alpha pla…

M Crítico vulnerabilidad

[CVE-2026-54627] SAIL is a cross-platform library for loading and saving images with support for animation, metadata,…

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, psd_private_sail_pixel_format() in src/sail-codecs/psd/helpers.c resolves a one-channel PSD in Bitmap color mode to SAIL_PIXEL_FORMAT_BPP1_INDEXED without requiring the file depth to be one, so the pixel buffer uses one-bit rows while sail_codec_load_frame_v…

M Crítico vulnerabilidad

[CVE-2026-54626] SAIL is a cross-platform library for loading and saving images with support for animation, metadata,…

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGA_INDEXED_RLE path selected by image_type == 9 allocates an image buffer using the one-byte-per-pixel SAIL_PIXEL_FORMAT_BPP8_INDEXED format returned by tga_private_sail_pixel_format() in src/sail-codecs/tga/helpers.c, while sail_codec_load_frame_v8_tga…

M Crítico vulnerabilidad

[CVE-2026-19773] libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerabili…

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper valid…

1 2 3 … 6 Siguiente →