Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers Password Generator VPN PSK Generator
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV Vigía LATAM
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
25,098
Total alertas
5091
Críticas
19172
Altas
8
Ransomware
2620
Esta semana
RSS
Vulnerabilidades × Alta × Limpiar todo ×
M Alto vulnerabilidad
08/09/2026
CVE-2026-72947 Windows File History Service Elevation of Privilege Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-72947 Windows File History Service Elevation of Privilege Vulnerability. Tipo: Elevación de Privilegios (EoP).
windowseop Microsoft MSRC
M Alto vulnerabilidad
08/09/2026
CVE-2026-66816 Microsoft SQL Server Security Feature Bypass Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-66816 Microsoft SQL Server Security Feature Bypass Vulnerability. Tipo: Bypass de Característica de Seguridad.
sql-serversfb Microsoft MSRC
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76967] SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally…
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This res…
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-76958] SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources i…
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging…
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
08/09/2026
[CVE-2026-66767] SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a…
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the applic…
nvdaltovulnerabilidad CVSS 7.7 NVD
F Alto vulnerabilidad
08/09/2026
Broken Access control on Websocket streams
Fortinet PSIRT publica advisory de seguridad: Broken Access control on Websocket streams. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortisoar.
firewall PAN PSIRT
F Alto vulnerabilidad
08/09/2026
Workflow session email approval process bypass
Fortinet PSIRT publica advisory de seguridad: Workflow session email approval process bypass. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortimanager.
firewallfortimanager PAN PSIRT

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86544] knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code acti…
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86439] knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing atta…
knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86538] knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/prev…
knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read sensitive files like credentials and configuration through the JSON response.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86539] knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embeddin…
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86540] knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project co…
knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86541] knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() func…
knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can supply absolute paths or relative paths containing directory traversal sequences to write malicious content to sensitive files like shell startup scripts or SSH configuration files.
nvdaltovulnerabilidad CVSS 8.3 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86437] Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with o…
Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which exec…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86438] Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire a…
Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote code execution.
nvdaltovulnerabilidad CVSS 7.2 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86498] In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed…
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
nvdaltovulnerabilidad CVSS 7.7 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86502] In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server a…
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86504] In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev …
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86492] In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub …
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
nvdaltovulnerabilidad CVSS 8.5 NVD
M Alto vulnerabilidad
07/09/2026
[CVE-2026-86494] In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links…
In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues
nvdaltovulnerabilidad CVSS 7.7 NVD