Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
13,539
Total alertas
3075
Críticas
10192
Altas
8
Ransomware
1790
Esta semana
RSS
Vulnerabilidades × critico × Limpiar todo ×
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39530] Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.
Unauthenticated SQL Injection in SpeakOut! Email Petitions
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39502] Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.
Unauthenticated SQL Injection in Form Maker by 10Web
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39511] Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.
Unauthenticated SQL Injection in WP Photo Album Plus
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39512] Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.
Unauthenticated SQL Injection in GeoDirectory
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39492] Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.
Unauthenticated SQL Injection in WP Maps
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39493] Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.
Unauthenticated SQL Injection in Simply Schedule Appointments
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39465] Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider
nvdcriticovulnerabilidad CVSS 9.1 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-34901] Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.
Unauthenticated Privilege Escalation in iControlWP
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-39441] Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free
nvdcriticovulnerabilidad CVSS 9.3 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-27053] Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50890] Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-gro…
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50883] An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows a…
An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts via a crafted payload.
nvdcriticovulnerabilidad CVSS 9.6 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50886] Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows at…
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50887] A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink…
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50873] An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allo…
An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file.
nvdcriticovulnerabilidad CVSS 9.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50880] An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to e…
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-49952] Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that…
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username paramet…
nvdcriticovulnerabilidad CVSS 9.1 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50869] An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory t…
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50871] An OS command injection vulnerability in the media archiving and export pipeline component of kanish…
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.
nvdcriticovulnerabilidad CVSS 9.8 NVD
M Crítico vulnerabilidad
15/06/2026
[CVE-2026-50872] An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attacker…
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.
nvdcriticovulnerabilidad CVSS 9.8 NVD