Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
Nuevo en 2MCI
Crear cuenta gratis Ver herramientas sin registro
Ya tengo cuenta
Iniciar sesión
Equipo
Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada hace 1 hora
22,162
Total alertas
4698
Críticas
16876
Altas
8
Ransomware
1037
Esta semana
RSS
Vulnerabilidades × cwe-502 × Limpiar todo ×
M Alto vulnerabilidad
20/08/2026
[CVE-2026-15679] Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution…
Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw …
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
20/08/2026
Inyección de Objetos PHP sin autenticación en FundEngine <= 1.7.9
Se ha identificado una vulnerabilidad crítica (CVSS 9.8) de inyección de objetos PHP en FundEngine versiones 1.7.9 y anteriores que permite a atacantes no autenticados ejecutar código arbitrario en servidores afectados. Esta vulnerabilidad representa un riesgo severo para plataformas de crowdfunding y gestión de fondos operadas en México y Latinoamérica. Los sistemas expuestos podrían comprometer datos financieros, información de usuarios y la integridad operacional de las aplicaciones.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-66672] Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
Unauthenticated PHP Object Injection in Flatastic
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
20/08/2026
[CVE-2026-66583] Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.
Unauthenticated PHP Object Injection in Forminator
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-76850] LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine…
LMDeploy deserializes disaggregated-serving peer messages with pickle. The handle_zmq_recv coroutine in lmdeploy/pytorch/disagg/conn/engine_conn.py reads peer-to-peer cache-free requests with recv_pyobj(), which deserializes the received bytes with pickle.loads(), and the isinstance check against DistServeCacheFreeRequest runs only after deserialization has already completed. The peer that supplie…
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-76404] In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execut…
In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-76395] In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute ar…
In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit deserializes sparse matrix data without guarding against embedded pickle content. For more information see Tro…
nvdaltovulnerabilidad CVSS 8.8 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
19/08/2026
[CVE-2026-44901] Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4…
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compro…
nvdaltovulnerabilidad CVSS 8.4 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-49816] Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vuln…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Alto vulnerabilidad
19/08/2026
[CVE-2026-49817] Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vuln…
Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
nvdaltovulnerabilidad CVSS 7.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73389] Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
Unauthenticated PHP Object Injection in Kalles Addons
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
19/08/2026
[CVE-2026-73364] Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
Customer PHP Object Injection in Flexible Subscriptions
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
19/08/2026
Vulnerabilidad alta de deserialización en SPLWare esProc hasta versión 20260507
Se ha identificado una vulnerabilidad de deserialización insegura en SPLWare esProc que afecta la función ObjectInputStream.readUnshared en SocketData.java. Un atacante remoto puede explotar esta falla para ejecutar código arbitrario en sistemas que ejecuten versiones vulnerables, comprometiendo servidores de procesamiento de datos en empresas de LATAM que utilizan esta plataforma de análisis paralelo.
nvdaltovulnerabilidad CVSS 7.3 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-74012] Editor PHP Object Injection in TaxoPress <= 3.51.0 versions.
Editor PHP Object Injection in TaxoPress
nvdaltovulnerabilidad CVSS 8.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-73397] Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
Unauthenticated Deserialization of untrusted data in Youzify
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-73380] Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Popup by Supsystic
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-73376] Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-73366] Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
Unauthenticated PHP Object Injection in Easy Google Maps
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
18/08/2026
[CVE-2026-73341] Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
Unauthenticated PHP Object Injection in RegistrationMagic
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Alto vulnerabilidad
18/08/2026
[CVE-2026-66620] Editor PHP Object Injection in OptionTree <= 2.7.3 versions.
Editor PHP Object Injection in OptionTree
nvdaltovulnerabilidad CVSS 7.2 NVD