Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "Apache" — 240 resultados ✕ Limpiar búsqueda
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1777
Esta semana
RSS
Vulnerabilidades × Limpiar todo ×
M Crítico vulnerabilidad
10/06/2026
[CVE-2026-45556] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /waf///rule//save accepts a config_file_name form field that is passed straight through to config_mod.master_slave_upload_and_restart(...) as the destination path. The validation chain (_replace_config_path_to_correct → check_is_conf) only requires…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
10/06/2026
[CVE-2026-45558] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the HAProxy section-save endpoints (POST /api/service/haproxy//section/ and the PUT / global / defaults variants) accept a JSON option field that is not validated, not escaped, and is rendered verbatim into the generated HAProxy configuration via the sectio…
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Alto vulnerabilidad
10/06/2026
[CVE-2026-45549] Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8…
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_routes.py:166-179) has decorators @bp.post('/agent/action/') and @jwt_required() only — no role check, no group ownership check on the server_ip form field. Any authenticated user, including role 4 (guest), can start, stop, or restart the…
nvdaltovulnerabilidad CVSS 8.5 NVD
V Alto vulnerabilidad
10/06/2026
[CVE-2026-41732] JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning t…
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default allow-list. Affected versions: Spring for Apache Pulsar 2.0.0 through 2.0.5; 1.2.0 through 1.2.17; 1.1.0 t…
nvdaltovulnerabilidad CVSS 8.1 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-49975] Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to …
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-48913] Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already ex…
Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.67.
nvdaltovulnerabilidad CVSS 7.3 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-44185] Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker contr…
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.3 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
A Alto vulnerabilidad
08/06/2026
[CVE-2026-44186] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in …
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server. This issue affects undefined: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.3 NVD
A Crítico vulnerabilidad
08/06/2026
[CVE-2026-44631] Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configur…
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
08/06/2026
[CVE-2026-42535] A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to d…
A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-42536] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and…
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-34355] A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an …
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-34356] Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and Pr…
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie* This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdaltovulnerabilidad CVSS 7.5 NVD
A Crítico vulnerabilidad
08/06/2026
[CVE-2026-29167] Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration Thi…
Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Alto vulnerabilidad
08/06/2026
[CVE-2026-47430] ## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WK…
## Summary The iOS implementation of `cordova-plugin-inappbrowser` passes the `id` field from a `WKScriptMessage` body to `commandDelegate sendPluginResult:callbackId:` with no format validation (`CDVWKInAppBrowser.m:560–574`). Any web content loaded inside the InAppBrowser can fire any pending Cordova callback in the host app by posting a message whose `id` field is a guessable or enumerated cal…
nvdaltovulnerabilidad CVSS 7.5 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
A Crítico vulnerabilidad
04/06/2026
[CVE-2026-50076] Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK…
Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Java/JVM platforms allows a remote attacker to bypass class registration, TypeChecker, and DisallowedList checks and invoke classpath-present readResolve/readExternal hooks via crafted Fory serialized data. Users are recommended to upgrade to version 1.1.0 or later, which fixes thi…
nvdcriticovulnerabilidad CVSS 9.1 NVD
A Crítico vulnerabilidad
03/06/2026
[CVE-2026-47065] ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Pro…
ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.readProxyDesc() is dispatched. JDK then calls the default ObjectInputStream.resolveProxyClass(interfaces) implementation, which perform…
nvdcriticovulnerabilidad CVSS 9.8 NVD
A Crítico vulnerabilidad
07/05/2026
Vulnerabilidad crítica de ejecución remota de código en Azure Managed Instance for Apache Cassandra (CVE-2026-33109)
Microsoft ha identificado una vulnerabilidad de ejecución remota de código (RCE) en Azure Managed Instance for Apache Cassandra que permite a atacantes no autenticados ejecutar código arbitrario en instancias afectadas. Esta vulnerabilidad impacta directamente a empresas en México y Latinoamérica que utilicen este servicio para bases de datos distribuidas en producción, representando un riesgo crítico de compromiso total de la infraestructura. La ausencia de autenticación previa amplifica significativamente el riesgo de explotación masiva.
azurerce Microsoft MSRC
A Crítico vulnerabilidad
07/05/2026
Vulnerabilidad crítica de ejecución remota de código en Azure Managed Instance for Apache Cassandra (CVE-2026-33844)
Se ha identificado una vulnerabilidad de ejecución remota de código (RCE) en Azure Managed Instance for Apache Cassandra que permite a atacantes no autenticados ejecutar código arbitrario en instancias afectadas. Esta falla impacta directamente a empresas mexicanas y latinoamericanas que utilizan Cassandra gestionado en Azure para bases de datos de producción críticas. La explotación no requiere credenciales, lo que eleva significativamente el riesgo de compromiso total de la infraestructura de datos.
azurerce Microsoft MSRC
A Alto vulnerabilidad KEV
16/04/2026
Vulnerabilidad crítica en Apache ActiveMQ bajo explotación activa
Apache ha confirmado explotación activa de CVE-2026-34197 en Apache ActiveMQ. CISA ha establecido el 30 de abril de 2026 como fecha límite para remediar la vulnerabilidad en sistemas federales estadounidenses. Aunque no se ha detectado uso en campañas de ransomware conocidas, organizaciones en México y LATAM deben considerar este plazo como referencia de urgencia máxima dado el estado de explotación activa.
apacheexplotación activavulnerabilidad CISA KEV