Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI Noticias ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
22,394
Total alertas
4758
Críticas
17006
Altas
8
Ransomware
1261
Esta semana
RSS
Vulnerabilidades × Crítica × Limpiar todo ×
M Crítico vulnerabilidad
08/09/2026
CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-68833 Windows NTFS Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
CVE-2026-71329 Windows NTFS Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-71329 Windows NTFS Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
CVE-2026-71350 Windows Spaceport.sys Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-71350 Windows Spaceport.sys Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
CVE-2026-71348 Windows Spaceport.sys Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-71348 Windows Spaceport.sys Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-77887 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability
Microsoft publica advisory de seguridad: CVE-2026-77891 Windows DHCP Server Remote Code Execution Vulnerability. Tipo: Ejecución Remota de Código (RCE).
windowsrce Microsoft MSRC
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-86510] A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params …
A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
nvdcriticovulnerabilidad CVSS 9.9 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-76969] @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multit…
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. …
nvdcriticovulnerabilidad CVSS 9.4 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-86509] A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of t…
A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-66768] SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked fro…
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and avai…
nvdcriticovulnerabilidad CVSS 9.0 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-58240] SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application…
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confide…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
08/09/2026
[CVE-2026-44756] A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Und…
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availabil…
nvdcriticovulnerabilidad CVSS 10.0 NVD
F Crítico vulnerabilidad
08/09/2026
JWT used for authentication in web GUI signed with static key
Fortinet PSIRT publica advisory de seguridad: JWT used for authentication in web GUI signed with static key. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortimonitor.
firewall PAN PSIRT
F Crítico vulnerabilidad
08/09/2026
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Fortinet PSIRT publica advisory de seguridad: Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information. Tipo: Control de Acceso Inadecuado. Producto afectado: Fortisandbox.
firewallfortisandbox PAN PSIRT
F Crítico vulnerabilidad
08/09/2026
Uncontrolled Resource Consumption in SNMP
Fortinet PSIRT publica advisory de seguridad: Uncontrolled Resource Consumption in SNMP. Tipo: Denegación de Servicio (DoS). Producto afectado: Fortianalyzer.
firewallfortianalyzer PAN PSIRT

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
F Crítico vulnerabilidad
08/09/2026
ZTNA Portal Improper Certificate Validation
Fortinet PSIRT publica advisory de seguridad: ZTNA Portal Improper Certificate Validation. Tipo: Vulnerabilidad de seguridad. Producto afectado: Fortios.
firewallfortios PAN PSIRT
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-86542] knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated a…
knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in the name parameter to escape the imports directory and overwrite arbitrary files writable by the server process.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-86543] knowns versions before 0.30.0 serve the management API without authentication on all network interfa…
knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicly accessible address.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-75650] Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engi…
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
nvdcriticovulnerabilidad CVSS 10.0 NVD
M Crítico vulnerabilidad
07/09/2026
[CVE-2026-86480] In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service an…
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges
nvdcriticovulnerabilidad CVSS 9.8 NVD