Alertas de Seguridad de la Información

M Alto vulnerabilidad

31/08/2026

Vulnerabilidad alta en D-Link DSM-G600 1.01 permite escritura fuera de límites

Se ha identificado una debilidad en el manejador multiparte del archivo /load_file.cgi en dispositivos D-Link DSM-G600 versión 1.01, que permite escritura fuera de límites (out-of-bounds write) explotable remotamente. Con CVSS 8.8, esta vulnerabilidad afecta directamente a empresas en LATAM que utilizan estos dispositivos en infraestructuras de almacenamiento NAS, permitiendo a atacantes comprometer sistemas sin autenticación. El exploit está disponible públicamente, elevando significativamente el riesgo de explotación inmediata.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82616] A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUpl…

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

31/08/2026

[CVE-2026-82608] A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes o…

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modules/ims_registrar_scscf/cxdx_avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This patch is called abb5d60af6eefbd367bf6588c5589566b090…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

31/08/2026

[CVE-2026-82593] A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /bo…

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub_41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fota_url causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

30/08/2026

[CVE-2026-82592] A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the f…

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

30/08/2026

[CVE-2026-82542] A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formI…

A weakness has been identified in Tenda HG10 300001138. Affected by this issue is the function formIPv6Routing of the file /boaform/admin/formIPv6Routing of the component Boa Web Server. This manipulation of the argument destNet causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

30/08/2026

Vulnerabilidad crítica en TOTOLINK A720R permite corrupción de memoria remota

Se identificó una vulnerabilidad de score CVSS 9.1 en el router TOTOLINK A720R versión 4.1.5cu.630_B20250509 que afecta la función setMacFilterRules del componente MAC Filtering. Un atacante remoto puede manipular el parámetro 'desc' para causar corrupción de memoria y potencial ejecución de código. El exploit ha sido divulgado públicamente, aumentando el riesgo inmediato para empresas en LATAM que utilizan este dispositivo en infraestructuras críticas.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Alto vulnerabilidad

30/08/2026

Vulnerabilidad alta de desbordamiento de búfer en NASA Trick 19.6.0 (CVE-2026-82478)

Se identificó una vulnerabilidad de desbordamiento de búfer en pila en NASA Trick 19.6.0, específicamente en la función JSONVariableServerThread::parse_request del manejador de sockets TCP. Esta falla permite ejecución remota de código sin autenticación previa. Afecta principalmente a instituciones de investigación, universidades y centros aeroespaciales en Latinoamérica que utilizan esta herramienta de simulación científica.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

27/08/2026

Vulnerabilidad alta en WibuKey64.sys permite escalada de privilegios en Windows

Se descubrió una validación deficiente de límites de memoria en WibuKey versión 6.70 y anteriores para Windows, que permite a atacantes manipular punteros y ejecutar código con privilegios de sistema. La vulnerabilidad afecta principalmente a empresas que utilizan soluciones de licenciamiento Wibu-Systems en México y Latinoamérica, exponiendo servidores y estaciones de trabajo a denegación de servicio, escalada de privilegios y potencial ejecución remota de código.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

25/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en TOTOLINK N600R 4.3.0cu.7647_B20210106

Se ha identificado una vulnerabilidad de desbordamiento de búfer en pila (stack-based buffer overflow) en el controlador CGI del router TOTOLINK N600R versión 4.3.0cu.7647_B20210106. La falla reside en la función setSystemConfig del archivo /cgi-bin/cstecgi.cgi y puede ser explotada remotamente manipulando el parámetro Hostname. Con CVSS 10.0, esta vulnerabilidad permite ejecución de código remoto sin autenticación y afecta a equipos de red en empresas, ISPs y centros de datos en toda Latinoamérica.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2026-79069] Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacke…

Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2022-50999] Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer…

Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

25/08/2026

[CVE-2021-47996] Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundl…

Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-boun…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

24/08/2026

[CVE-2026-78169] A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the functio…

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78170] A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the…

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78161] A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor o…

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78157] A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file …

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. It is possible to initiate the attack remotely. The patch is named c18dc6938bf63cc7374315d3dca303d92066e746. To fix this issue, it is recommended to deploy a patch.

nvdaltovulnerabilidad CVSS 7.4 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-78156] A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function …

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. The attack may be performed from remote. The name of the patch is a9c82ee0b590d76a581b058…

nvdaltovulnerabilidad CVSS 7.4 NVD

M Crítico vulnerabilidad

23/08/2026

Desbordamiento de búfer en Comfast CF-N1-S 2.6.0 permite ejecución remota de código

Se identificó una vulnerabilidad crítica (CVSS 9.9) en enrutadores Comfast CF-N1-S versión 2.6.0.1 en el componente de administración web. Un atacante remoto puede explotar un desbordamiento de búfer en la pila mediante manipulación de los parámetros timestr/ntp_client_enabled en la función /cgi-bin/mbox-config para ejecutar código arbitrario. El exploit es público y activamente utilizado en ataques.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

22/08/2026

Vulnerabilidad crítica de desbordamiento de búfer en TRENDnet TEW-821DAP 2.2.01b05

Se identificó una vulnerabilidad de severidad crítica (CVSS 10.0) en el manejador de configuración NTP del dispositivo TRENDnet TEW-821DAP versión 2.2.01b05. Un atacante puede manipular parámetros de zona horaria y servidores NTP a través del archivo /cgi-bin/apply_time.cgi para provocar un desbordamiento de búfer en la pila de memoria. Esta vulnerabilidad afecta principalmente a pequeñas y medianas empresas en LATAM que utilizan estos enrutadores/puntos de acceso en infraestructuras de red crítica sin internet directo.

nvdcriticovulnerabilidad CVSS 10.0 NVD