Alertas de Seguridad de la Información

M Alto vulnerabilidad Nuevo

Hace 2 horas

[CVE-2026-78170] A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the…

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirectionW. Executing a manipulation of the argument ssid can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

Hace 3 días

[CVE-2026-17040] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary cod…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

Hace 3 días

[CVE-2026-18279] Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability a…

Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SETUP RTSP packets. The issue results from the lack of proper validation of …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

Hace 4 días

[CVE-2026-14970] IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registrat…

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-24184] NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon com…

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending crafted LLDP frames. A successful exploit of this vulnerability might lead to code execution.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

Hace 5 días

[CVE-2026-70415] Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS…

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in the NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution and Denial of service.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

16/08/2026

[CVE-2026-19961] A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of…

A vulnerability was detected in Edimax EW-7478APC 1.04. Affected is the function formWlSiteSurvey of the file /goform/formWlSiteSurvey. Performing a manipulation of the argument selSSID results in buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19821] A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the …

A vulnerability was determined in Tenda AC12 15.03.06.23_multi_TD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

14/08/2026

[CVE-2026-19792] A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapp…

A security flaw has been discovered in Tenda G0 up to 20260625. Impacted is the function setPortMapping of the file /goform/module of the component httpd web management interface. Performing a manipulation of the argument portMappingServer/porMappingtInternal/portMappingExternal results in buffer overflow. The attack is possible to be carried out remotely. The exploit has been released to the publ…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

13/08/2026

[CVE-2026-17220] IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify a…

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/08/2026

[CVE-2026-19002] A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector …

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client appli…

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/08/2026

Desbordamiento de búfer alta en Fortinet FortiClient Windows permite ejecución remota de código

Una vulnerabilidad de desbordamiento de búfer en Fortinet FortiClient Windows (versiones 7.2.0-7.2.11 y 7.4.0-7.4.3) permite a atacantes no autenticados ejecutar código arbitrario manipulando respuestas DNS. El ataque requiere posición en la red para alterar tráfico DNS, afectando principalmente a empresas en LATAM con VPN corporativos que confían en FortiClient para acceso remoto seguro.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Crítico vulnerabilidad

12/08/2026

Vulnerabilidad crítica de buffer overflow en servicios PROFINET (CVE-2025-41769)

Los dispositivos con servicio PROFINET están expuestos a un buffer overflow en configuración por defecto que permite a atacantes remotos no autenticados ejecutar código arbitrario o reiniciar los equipos. Esta vulnerabilidad afecta principalmente infraestructura industrial, sistemas de automatización y dispositivos IoT en plantas manufactureras, utilities y sectores críticos en LATAM. La ausencia de autenticación requerida amplifica significativamente el riesgo de explotación.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

11/08/2026

[CVE-2026-15565] A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint witho…

A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

08/08/2026

[CVE-2026-71957] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

08/08/2026

[CVE-2026-71958] D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain …

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20348] A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attac…

A vulnerability in the XAR file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in XAR files during scanning. An attacker could exploit this vulnerability by submitting a crafted file th…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

07/08/2026

[CVE-2026-20337] A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker …

A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A succe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

06/08/2026

[CVE-2026-67871] Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of …

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_server

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

04/08/2026

[CVE-2026-45537] OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 an…

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component lengt…

nvdcriticovulnerabilidad CVSS 9.1 NVD