Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "X" — 16168 resultados ✕ Limpiar búsqueda
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1038
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-91136] The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and inclu…
The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — san…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-96662] The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPres…
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to a…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-96765] The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vul…
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user a…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93945] Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injecti…
Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93949] Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shoppi…
Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93950] Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Co…
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93951] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-96278] The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUES…
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass wor…
nvdaltovulnerabilidad CVSS 7.2 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93936] Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Inject…
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93937] Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injectio…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93938] Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object In…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93940] Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Inject…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93941] Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injectio…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93942] Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injectio…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93943] Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Inject…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93944] Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Inje…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93927] Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.Thi…
Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93929] Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object In…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93930] Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Inject…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad Nuevo
Ahora mismo
[CVE-2026-93931] Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injectio…
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
nvdcriticovulnerabilidad CVSS 9.8 NVD