Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,539
Total alertas
3075
Críticas
10192
Altas
8
Ransomware
1764
Esta semana
RSS
Vulnerabilidades × critico × Limpiar todo ×
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-39574] Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
Unauthenticated SQL Injection in InPost Gallery
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-49772] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2.
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
16/06/2026
[CVE-2026-49774] Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station al…
Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-12205] Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key …
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical "r". Keys used to sign more than once with an affected versio…
nvdcriticovulnerabilidad CVSS 9.1 NVD
I Crítico vulnerabilidad
15/06/2026
[CVE-2026-48713] Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when u…
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queued missing-key string on the configured keySeparator (default .) before calling the internal setPath() walker. The walker (getLastOfPath in l…
nvdcriticovulnerabilidad CVSS 9.1 NVD
I Crítico vulnerabilidad
15/06/2026
[CVE-2026-48714] i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti…
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-k…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-12087] Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_s…
Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then c…
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-11832] Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The defa…
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-9691] Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, …
Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-52703] Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.
Unauthenticated Path Traversal in FastDup
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-52693] Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.
Unauthenticated SQL Injection in eCommerce Product Catalog
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49770] Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.
Unauthenticated PHP Object Injection in WP Travel Engine
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49776] Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatica…
Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49781] Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.
Unauthenticated PHP Object Injection in OttoKit
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49763] Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.
Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49764] Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.
Unauthenticated Broken Authentication in RegistrationMagic
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49765] Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Eleme…
Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49766] Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.
Subscriber Arbitrary File Deletion in WP User Manager
nvdcriticovulnerabilidad CVSS 9.9 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49768] Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.
Unauthenticated PHP Object Injection in Happyforms
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49769] Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.
Unauthenticated PHP Object Injection in wpForo Forum
nvdcriticovulnerabilidad CVSS 9.8 NVD