Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →

Última alerta publicada ahora mismo

14,046

Total alertas

3206

Críticas

10568

Altas

8

Ransomware

1052

Esta semana

RSS

alto × Limpiar todo ×

K Alto vulnerabilidad

[CVE-2026-57573] Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API serv…

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to the crawler with no destination validation, allowing a remote unauthenticated client to call POST /crawl/stream or POST /crawl with crawler_c…

M Alto vulnerabilidad

[CVE-2026-59712] Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing aut…

Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users.getUser with arbitrary user IDs to enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hija…

M Alto vulnerabilidad

[CVE-2026-59713] Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally …

Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

T Alto vulnerabilidad

[CVE-2026-54765] Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik…

Traefik is an open source HTTP reverse proxy and load balancer. From v3.7.0 prior to v3.7.6, Traefik's Kubernetes Gateway API provider may resolve two accepted HTTPRoutes that target the same backend Service:port but configure different backendRef filters to the same child service and apply only one route's filter set to all requests reaching that backend. In Gateway deployments where backendRef f…

V Alto vulnerabilidad

[CVE-2026-55574] vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation timeout; in the xgrammar backend the string reaches the regex compiler with no guard, and in the outlines backend the validation step blocks st…

M Alto vulnerabilidad

[CVE-2026-55727] A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0…

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

V Alto vulnerabilidad

[CVE-2026-54234] vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.…

vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size boundary value, which is then converted to negative one when the engine selects the next live token for a request and is written back into t…

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →

Q Alto vulnerabilidad

[CVE-2026-25268] Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching oper…

Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations.

Q Alto vulnerabilidad

[CVE-2026-25271] Memory Corruption when processing asynchronous input parameters due to improper handling of modified…

Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use.

M Alto vulnerabilidad

[CVE-2026-14468] HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of r…

HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion proce…

M Alto vulnerabilidad

[CVE-2026-14471] Improper Neutralization of Special Elements in the metrics-service retention policy management compo…

Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position. To remediate this issue, users should upgrade to version 1.0.13 or later.

Q Alto vulnerabilidad

[CVE-2026-21379] Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Q Alto vulnerabilidad

[CVE-2026-21383] Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requir…

Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

D Alto vulnerabilidad

[CVE-2026-14536] Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.…

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.

P Alto vulnerabilidad

[CVE-2026-54059] Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph d…

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →

P Alto vulnerabilidad

[CVE-2026-54060] Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled pe…

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

P Alto vulnerabilidad

[CVE-2026-55379] Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX widt…

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

P Alto vulnerabilidad

[CVE-2026-55380] Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read ima…

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

M Alto vulnerabilidad

[CVE-2026-13753] A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Pri…

A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version

B Alto vulnerabilidad

[CVE-2026-40140] BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication v…

BeyondTrust Remote Support and Privileged Remote Access contain a high-severity pre-authentication vulnerability in the network communication subsystem. Insufficient validation of client-supplied input may allow an unauthenticated remote attacker to trigger a denial-of-service condition affecting appliance availability.

← Anterior 1 … 337 338 339 340 341 … 514 Siguiente →