Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,298
Total alertas
4744
Críticas
16966
Altas
8
Ransomware
1168
Esta semana
RSS
Vulnerabilidades × Crítica × Limpiar todo ×
M Crítico vulnerabilidad
18/09/2026
Vulnerabilidad crítica en Synology DiskStation Manager permite lectura/escritura de archivos arbitrarios
Una falla en la codificación de salida del componente SCGI en Synology DSM afecta versiones anteriores a 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 y 7.4-90075, permitiendo a atacantes remotos leer, modificar archivos arbitrarios y ejecutar ataques de negación de servicio. Empresas en LATAM que usan NAS Synology para almacenamiento centralizado están en riesgo inmediato de exposición de datos sensibles e interrupciones operativas.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/09/2026
Vulnerabilidad crítica en Synology DiskStation Manager permite lectura/escritura de archivos arbitrarios
Se identificó una vulnerabilidad de entropía insuficiente en la lógica de autenticación de Synology DSM (versiones anteriores a 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 y 7.4-90075) que permite a atacantes remotos acceder, modificar archivos arbitrarios y ejecutar ataques de denegación de servicio sin credenciales válidas. Afecta directamente a servidores NAS en entornos corporativos, PyMES y centros de datos en LATAM que dependen de estos dispositivos para almacenamiento centralizado.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-67100] HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure fla…
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-67101] HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in i…
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-84738] The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through…
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-93467] The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote…
The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-85878] Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate pri…
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-69843] Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate pri…
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
18/09/2026
[CVE-2026-62874] Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to e…
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85885] Improper neutralization of special elements used in a command ('command injection') in M365 Copilot …
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-85889] Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to …
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-87701] Improper neutralization of special elements in output used by a downstream component ('injection') i…
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-83944] Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges ov…
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-77903] Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate …
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70200] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-70009] Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows a…
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69865] Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthori…
Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-69399] Azure Arc Elevation of Privilege Vulnerability
Azure Arc Elevation of Privilege Vulnerability
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-54734] Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters in…
Prebid Server Java is the Java version of Prebid Server. Prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, potentially reaching internal network …
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
17/09/2026
[CVE-2026-54767] WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controlle…
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafis…
nvdcriticovulnerabilidad CVSS 9.1 NVD