Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,509
Total alertas
3066
Críticas
10171
Altas
8
Ransomware
1810
Esta semana
RSS
Vulnerabilidades × cwe-79 × Limpiar todo ×
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65443] Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
Unauthenticated Cross Site Scripting (XSS) in BackWPup
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65446] Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
Unauthenticated Cross Site Scripting (XSS) in Kali Forms
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65447] Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-61957] Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65437] Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.…
Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65438] Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65439] Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7
nvdaltovulnerabilidad CVSS 7.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
27/07/2026
[CVE-2026-65440] Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
Unauthenticated Cross Site Scripting (XSS) in GetGenie
nvdaltovulnerabilidad CVSS 7.1 NVD
M Crítico vulnerabilidad
27/07/2026
[CVE-2026-66395] SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar p…
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-66396] SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Ga…
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-66394] SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanit…
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, e…
nvdaltovulnerabilidad CVSS 8.7 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59553] Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59556] Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <=…
Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-59558] Unauthenticated Cross Site Scripting (XSS) in Booking Calendar <= 11.4.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Booking Calendar
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
27/07/2026
[CVE-2026-13726] The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it…
The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.
nvdaltovulnerabilidad CVSS 7.1 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
26/07/2026
[CVE-2026-17496] NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injec…
NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to inc…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
24/07/2026
[CVE-2026-15401] The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc…
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vbf…
nvdaltovulnerabilidad CVSS 7.2 NVD
P Alto vulnerabilidad
23/07/2026
[CVE-2026-15968] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i…
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
23/07/2026
[CVE-2026-47743] Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewir…
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to ta…
nvdaltovulnerabilidad CVSS 8.7 NVD
C Alto vulnerabilidad
23/07/2026
[CVE-2026-65898] DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an u…
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as s…
nvdaltovulnerabilidad CVSS 7.2 NVD