Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
26,590
Total alertas
5368
Críticas
20330
Altas
8
Ransomware
1697
Esta semana
RSS
Vulnerabilidades × Alta × Limpiar todo ×
M Alto vulnerabilidad
10/10/2026
[CVE-2026-40803] Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-40805] Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
Subscriber Arbitrary File Deletion in PeepSo
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-42630] Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions…
Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-42631] Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Music
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-42632] Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-27350] Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Requ…
Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-39799] Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
Unauthenticated Cross Site Scripting (XSS) in WP File Download
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
10/10/2026
[CVE-2026-39800] Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versi…
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-39802] Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
Unauthenticated Remote Code Execution (RCE) in Everest Backup
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-40777] Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
Subscriber Broken Access Control in WPSection
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-40801] Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
Subscriber Broken Access Control in Wordable
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-96341] Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Esca…
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-57806] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-94160] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-106608] Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege …
Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
10/10/2026
[CVE-2026-106609] Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiti…
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-62044] Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player al…
Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-103071] Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page…
Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-108550] SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and …
SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/10/2026
[CVE-2026-108553] OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows comman…
OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.
nvdaltovulnerabilidad CVSS 7.5 NVD