Alertas de Seguridad de la Información

M Alto vulnerabilidad

11/08/2026

[CVE-2026-50058] A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Ed…

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted DFT files. This could allow an attacker to execute code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-50062] A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Ed…

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-50063] A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Ed…

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds read vulnerability while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

10/08/2026

[CVE-2026-72568] An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attack…

An out-of-bounds read vulnerability in Redis through 8.8.1 allows an adjacent unauthenticated attacker to cause denial of service or information disclosure by sending a specially crafted PING message to the Redis Cluster Bus port.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

07/08/2026

Vulnerabilidad alta en gopacket permite denegación de servicio remota en aplicaciones Go

gopacket versión 1.7.0 y anteriores contiene múltiples decodificadores de capas que procesan longitudes, conteos u offsets controlados por el atacante sin validar contra los búferes de paquetes, permitiendo panic remoto. Aplicaciones que utilizan DecodingLayerParser o DecodeFromBytes en infraestructuras de análisis de tráfico, cortafuegos o sistemas de detección de intrusiones en LATAM son susceptibles a denegación de servicio remota.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-19082] Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-…

Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII EXIF tag's length as `entry->size - 1` to strip the trailing NUL. A zero-count ASCII entry sets `entry->size` to 0, and the derived length reaches i_tags_add() as -1, which is interpreted as a request …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20346] A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the PDF file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PDF files during scanning, which may result in an out-of-bounds buffer read. An attacker could exploit …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20347] A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote at…

A vulnerability in the Mach-O file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of&nbsp;memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in Mach-O files during scanning, which may result in an out-of-bounds buffer read. An attacker could ex…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70635] TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability th…

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow dictionary-index type and bypasses index validation checks in bulk text dictionary decompression. Attackers with …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-70634] TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionar…

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-5855] Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-s…

Contiki-NG's LwM2M TLV parser lwm2m_tlv_read() in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP WRITE to any LwM2M endpoint whose final TLV supplies exactly one byte triggers up to five out-of-bo…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-5856] Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name…

Contiki-NG's DNS/mDNS resolver skip_name() in os/services/resolv/resolv.c walks DNS wire-format name labels with no packet-boundary check, and the caller in newdata() invokes it in a loop iterating nquestions times from the attacker-controlled DNS header before validating the transaction ID. An attacker who sets nquestions higher than the number of complete questions present causes skip_name() to …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-43628] llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerabili…

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEG…

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-11803] A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read …

A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Crítico vulnerabilidad

05/08/2026

Vulnerabilidad crítica en nanoMODBUS v1.23.0: lectura fuera de límites en identificación de dispositivos

nanoMODBUS hasta la versión 1.23.0 contiene una vulnerabilidad de lectura fuera de los límites de la pila que permite escritura de punteros salvajes en la función nmbs_read_device_identification_basic(). Un campo object_id no validado (0-255) desde la red causa acceso a memoria no inicializada. Afecta sistemas SCADA, HMI y equipos IoT industriales en plantas manufactureras y servicios críticos de LATAM.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

03/08/2026

[CVE-2026-20479] In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to r…

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00741071; Issue ID: MSV-7620.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/08/2026

Vulnerabilidad alta en cliente OCPP 1.6: desbordamiento de buffer en parse_rpc_msg()

Se detectó una falla de seguridad en el procesamiento de marcos WAMP RPC dentro del cliente OCPP 1.6 (subsys/net/lib/ocpp). La función extract_string_field() utiliza strncpy() sin garantizar NUL-terminación, permitiendo lectura de memoria adyacente mediante campos uid y action malformados. Esto afecta sistemas de carga de vehículos eléctricos y controladores IoT en infraestructura de movilidad en Latinoamérica.

nvdaltovulnerabilidad CVSS 7.0 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad de lectura fuera de límites en FreeRDP anterior a 3.29.0

FreeRDP versiones anteriores a 3.29.0 contienen vulnerabilidades de lectura fuera de límites en el proxy de mensajes de actualización asincrónica para los órdenes de dibujo primarios PolygonSC y PolygonCB. Cuando AsyncUpdate está habilitado, las funciones update_message_PolygonSC() y update_message_PolygonCB() asignan un array de puntos fresco pero copian datos desde direcciones de memoria incorrectas, potencialmente exponiendo información sensible o causando fallos en sistemas que utilizan sesiones RDP remotas.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP: lectura fuera de límites en caché de glifos (CVE-2026-67291)

FreeRDP versiones 3.28.0 y anteriores contienen una vulnerabilidad de lectura heap out-of-bounds en el procesamiento de fragmentos de glifos. Un atacante remoto puede explotar este defecto a través de actualizaciones GLYPH_FRAGMENT_ADD malformadas sin autenticación previa, afectando servidores RDP en infraestructuras altas. Con CVSS 7.5, esta vulnerabilidad impacta directamente a centros de datos, instituciones financieras y administraciones públicas que utilicen FreeRDP para acceso remoto.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

01/08/2026

Vulnerabilidad alta en FreeRDP: desbordamiento de búfer en decodificador TSMF FFmpeg

FreeRDP anterior a versión 3.29.0 contiene una vulnerabilidad de lectura fuera de los límites de memoria en el decodificador TSMF FFmpeg al procesar tipos de medios AVC1 MPEG2VIDEOINFO con datos insuficientes. Un atacante puede enviar datos de formato multimedia malformados desde un servidor RDP para causar un fallo del cliente. Esta vulnerabilidad afecta directamente a entornos de escritorio remoto y soluciones de virtualización ampliamente utilizadas en empresas LATAM.

nvdaltovulnerabilidad CVSS 7.5 NVD