Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

13,394

Total alertas

3047

Críticas

10075

Altas

8

Ransomware

1741

Esta semana

RSS

cwe-121 × Limpiar todo ×

M Alto vulnerabilidad

[CVE-2026-17494] IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability…

IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integ…

M Crítico vulnerabilidad

[CVE-2026-16687] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and …

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, inte…

M Alto vulnerabilidad

[CVE-2026-16832] IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and …

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and av…

M Alto vulnerabilidad

[CVE-2026-19234] IBM Power Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affect…

IBM Power Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentia…

M Alto vulnerabilidad

[CVE-2026-75142] FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpeg…

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer (libavformat/mpegenc.c). When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow during MPEG-PS muxing.

M Alto vulnerabilidad

[CVE-2026-45798] Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4…

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.5.0 until 4.14.6 and 5.0.0-beta2, compare_wazuh_versions() in src/shared/version_op.c copies the attacker-controlled enrollment V: field into a 10-byte stack buffer with strncpy() but does not explicitly terminate the buffer. The function is reachable before authentication through wazuh-authd on TC…

M Alto vulnerabilidad

[CVE-2026-49420] The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without check…

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

M Crítico vulnerabilidad

Vulnerabilidad crítica en Comfast CF-N1-S 2.6.0.1 permite desbordamiento de búfer remoto

Se ha identificado una falla de seguridad crítica (CVSS 10.0) en el dispositivo Comfast CF-N1-S versión 2.6.0.1 que afecta el procesamiento de parámetros URI en /cgi-bin/mbox-config. Un atacante remoto puede explotar un desbordamiento de búfer en la pila mediante manipulación de los parámetros width/height, comprometiendo completamente la integridad del dispositivo. Empresas en LATAM que utilicen estos puntos de acceso inalámbricos en infraestructura de oficinas o datos están en riesgo inmediato de intrusión no autorizada.

M Crítico vulnerabilidad

Vulnerabilidad crítica de desbordamiento de búfer en UTT HiPER 1200GW hasta versión 2.5.3-170306

Se ha identificado una debilidad en los equipos UTT HiPER 1200GW (versiones hasta 2.5.3-170306) que permite un desbordamiento de búfer basado en pila mediante manipulación remota del parámetro 'timestart' en la función strcpy del archivo /goform/formGroupConfig. Con puntuación CVSS 9.9, este dispositivo ampliamente utilizado en redes corporativas de LATAM como gateway de seguridad es vulnerable a ejecución remota de código. El exploit está disponible públicamente, elevando significativamente el riesgo de compromiso.

M Crítico vulnerabilidad

Vulnerabilidad crítica en UTT HiPER 1250GW permite ejecución remota de código (CVE-2026-76004)

Se ha identificado una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en UTT HiPER 1250GW versiones hasta 3.2.7-210907-180535. El fallo existe en el manejador HTTP del formulario /goform/aspApBasicConfigUrcp y puede ser explotado remotialmente sin autenticación manipulando el parámetro pvid. El exploit está públicamente disponible, poniendo en riesgo crítico los equipos desplegados en infraestructuras de ISPs, centros de datos y operadores de telecomunicaciones en América Latina.

M Crítico vulnerabilidad

[CVE-2026-75976] A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of …

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. Impacted is the function strcpy of the file /cgi-bin/wan.cgi of the component NVRAM. This manipulation of the argument wan_l2tp_password causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

M Crítico vulnerabilidad

[CVE-2026-75877] A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function Syst…

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03. This vulnerability affects the function SystemNetworkChanged/SystemDDNSChanged/SystemEmailChanged/SystemFTPChanged/websCheckRealm/FUN_00432574/FUN_0043372C of the component alphapd. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used.

M Crítico vulnerabilidad

[CVE-2026-75784] A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the functio…

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

M Crítico vulnerabilidad

[CVE-2026-75783] A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulner…

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within the local network. The exploit has been disclosed publicly and may be used.

M Alto vulnerabilidad

[CVE-2026-54758] Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs…

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the …

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

M Alto vulnerabilidad

[CVE-2026-73522] COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthentic…

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP datagram containing more than 15 ACF-CAN messages. The avtp_to_can() function increments its write index without bounding it against the caller-supplied array size, and because the listener accepts da…

M Alto vulnerabilidad

[CVE-2026-71979] INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f,…

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf()…

M Crítico vulnerabilidad

Vulnerabilidad crítica de desbordamiento de búfer en routers Wavlink WN531P3 y WN535M1

Se identificó una vulnerabilidad de desbordamiento de búfer en la pila (stack-based buffer overflow) en los routers Wavlink WN531P3 y WN535M1 versión V250922. La falla reside en la función strcpy del componente Export Pingortrace CGI (/etc/lighttpd/www/cgi-bin/export_pingortrace.cgi) y puede ser explotada remotamente manipulando el parámetro HTTP_COOKIE. El exploit ha sido divulgado públicamente, aumentando el riesgo para infraestructuras de telecomunicaciones y empresas en LATAM que utilizan estos equipos.

M Crítico vulnerabilidad

[CVE-2026-19959] A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetu…

A weakness has been identified in Edimax EW-7478APC 1.04. This affects the function formWanTcpipSetup of the file /goform/formWanTcpipSetup. This manipulation of the argument pppUserName causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclos…

M Alto vulnerabilidad

[CVE-2026-19847] A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the functi…

A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

← Anterior 1 2 3 4 … 14 Siguiente →